diff options
| author | Matvejchikov Ilya <matvejchikov@gmail.com> | 2011-12-13 23:09:08 +0300 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-04-08 16:19:15 -0400 |
| commit | 37eebe39c9731a76535f08de455db97eb93894ae (patch) | |
| tree | 5a31d3cab8c015302a2b4b9f542e838ba61c1bc5 /kernel | |
| parent | 19f949f52599ba7c3f67a5897ac6be14bfcb1200 (diff) | |
| download | op-kernel-dev-37eebe39c9731a76535f08de455db97eb93894ae.zip op-kernel-dev-37eebe39c9731a76535f08de455db97eb93894ae.tar.gz | |
audit: improve GID/EGID comparation logic
It is useful to extend GID/EGID comparation logic to be able to
match not only the exact EID/EGID values but the group/egroup also.
Signed-off-by: Matvejchikov Ilya <matvejchikov@gmail.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/auditsc.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index a371f85..77c705c 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -633,9 +633,23 @@ static int audit_filter_rules(struct task_struct *tsk, break; case AUDIT_GID: result = audit_gid_comparator(cred->gid, f->op, f->gid); + if (f->op == Audit_equal) { + if (!result) + result = in_group_p(f->gid); + } else if (f->op == Audit_not_equal) { + if (result) + result = !in_group_p(f->gid); + } break; case AUDIT_EGID: result = audit_gid_comparator(cred->egid, f->op, f->gid); + if (f->op == Audit_equal) { + if (!result) + result = in_egroup_p(f->gid); + } else if (f->op == Audit_not_equal) { + if (result) + result = !in_egroup_p(f->gid); + } break; case AUDIT_SGID: result = audit_gid_comparator(cred->sgid, f->op, f->gid); |
