summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/uapi/linux/audit.h3
-rw-r--r--kernel/audit.c3
-rw-r--r--kernel/auditsc.c3
3 files changed, 7 insertions, 2 deletions
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 9eddf2c..05e5e8f 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -386,7 +386,8 @@ struct audit_features {
__u32 lock; /* which features to lock */
};
-#define AUDIT_LAST_FEATURE -1
+#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0
+#define AUDIT_LAST_FEATURE AUDIT_FEATURE_ONLY_UNSET_LOGINUID
#define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE)
#define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */
diff --git a/kernel/audit.c b/kernel/audit.c
index 29ee6a4..fbfa3a7 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -144,7 +144,8 @@ static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
.features = 0,
.lock = 0,};
-static char *audit_feature_names[0] = {
+static char *audit_feature_names[1] = {
+ "only_unset_loginuid",
};
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index c75d781..924c0bf 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1974,6 +1974,9 @@ static int audit_set_loginuid_perm(kuid_t loginuid)
/* it is set, you need permission */
if (!capable(CAP_AUDIT_CONTROL))
return -EPERM;
+ /* reject if this is not an unset and we don't allow that */
+ if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) && uid_valid(loginuid))
+ return -EPERM;
return 0;
}
OpenPOWER on IntegriCloud