system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-11-05 18:23:50 +00:00
Code Issues Projects Releases Packages Wiki Activity

[AUDIT] create context if auditing was ever enabled

Browse source 
Disabling audit at runtime by auditctl doesn't mean that we can
stop allocating contexts for new processes; we don't want to miss them
when that sucker is reenabled.

(based on work from Al Viro in the RHEL kernel series)

Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris 2008-01-08 17:38:31 -05:00 committed by Al Viro
parent 50397bd1e4
commit b593d384ef
2 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
kernel/audit.c
View file

@ -70,6 +70,7 @@ static int audit_initialized;
#define AUDIT_ON 1 #define AUDIT_ON 1
#define AUDIT_LOCKED 2 #define AUDIT_LOCKED 2
int audit_enabled; int audit_enabled;
int audit_ever_enabled;
/* Default state when kernel boots without any parameters. */ /* Default state when kernel boots without any parameters. */
static int audit_default; static int audit_default;
@ -310,11 +311,17 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
static int audit_set_enabled(int state, uid_t loginuid, u32 sid) static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
{ {
int rc;
if (state < AUDIT_OFF || state > AUDIT_LOCKED) if (state < AUDIT_OFF || state > AUDIT_LOCKED)
return -EINVAL; return -EINVAL;
return audit_do_config_change("audit_enabled", &audit_enabled, state, rc = audit_do_config_change("audit_enabled", &audit_enabled, state,
loginuid, sid); loginuid, sid);
if (!rc)
audit_ever_enabled |= !!state;
return rc;
} }
static int audit_set_failure(int state, uid_t loginuid, u32 sid) static int audit_set_failure(int state, uid_t loginuid, u32 sid)
@ -857,6 +864,7 @@ static int __init audit_init(void)
skb_queue_head_init(&audit_skb_queue); skb_queue_head_init(&audit_skb_queue);
audit_initialized = 1; audit_initialized = 1;
audit_enabled = audit_default; audit_enabled = audit_default;
audit_ever_enabled |= !!audit_default;
/* Register the callback with selinux. This callback will be invoked /* Register the callback with selinux. This callback will be invoked
* when a new policy is loaded. */ * when a new policy is loaded. */
@ -884,8 +892,10 @@ static int __init audit_enable(char *str)
printk(KERN_INFO "audit: %s%s\n", printk(KERN_INFO "audit: %s%s\n",
audit_default ? "enabled" : "disabled", audit_default ? "enabled" : "disabled",
audit_initialized ? "" : " (after initialization)"); audit_initialized ? "" : " (after initialization)");
if (audit_initialized) if (audit_initialized) {
audit_enabled = audit_default; audit_enabled = audit_default;
audit_ever_enabled |= !!audit_default;
}
return 1; return 1;
} }

3
kernel/auditsc.c
View file

@ -70,6 +70,7 @@
#include "audit.h" #include "audit.h"
extern struct list_head audit_filter_list[]; extern struct list_head audit_filter_list[];
extern int audit_ever_enabled;
/* AUDIT_NAMES is the number of slots we reserve in the audit_context /* AUDIT_NAMES is the number of slots we reserve in the audit_context
* for saving names from getname(). */ * for saving names from getname(). */
@ -838,7 +839,7 @@ int audit_alloc(struct task_struct *tsk)
struct audit_context *context; struct audit_context *context;
enum audit_state state; enum audit_state state;
if (likely(!audit_enabled)) if (likely(!audit_ever_enabled))
return 0; /* Return if not auditing. */ return 0; /* Return if not auditing. */
state = audit_filter_task(tsk); state = audit_filter_task(tsk);