Skip to contentSkip to conversation

Audit: remove the limit on execve arguments when audit is running

PATCH New Eric Paris 1 participant 1 message Oct 8, 2007

Subsystems (2)
Proc sysctl Audit
lore
Share & tools
lore

Eric Paris

author maintainer
#0 lore raw

PATCH 3/3 Audit: remove the limit on execve arguments when audit is running

Remove the limitation on argv size. The audit system now logs arguments in smaller chunks (currently about 8k due to userspace audit system buffer sizes) so this is no longer a requirement.

Signed-off-by Eric Paris <[email protected]>
Acked-by Peter Zijlstra <[email protected]>

---

This patch hasn't changed since the last series, just reposted as 3/3 and rediffed.

 kernel/auditsc.c |   10 ----------
 kernel/sysctl.c  |   11 -----------
 2 files changed, 0 insertions(+), 21 deletions(-)
kernel/auditsc.c +0 -10
index ffc8d4b..5d39727 100644
@@ -1917,8 +1917,6 @@ int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode
 	return 0;
 }
 
-int audit_argv_kb = 32;
-
 int audit_bprm(struct linux_binprm *bprm)
 {
 	struct audit_aux_data_execve *ax;

@@ -1927,14 +1925,6 @@ int audit_bprm(struct linux_binprm *bprm)
 	if (likely(!audit_enabled || !context || context->dummy))
 		return 0;
 
-	/*
-	 * Even though the stack code doesn't limit the arg+env size any more,
-	 * the audit code requires that _all_ arguments be logged in a single
-	 * netlink skb. Hence cap it :-(
-	 */
-	if (bprm->argv_len > (audit_argv_kb << 10))
-		return -E2BIG;
-
 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
 	if (!ax)
 		return -ENOMEM;
kernel/sysctl.c +0 -11
index 53a456e..88e5d06 100644
@@ -77,7 +77,6 @@ extern int percpu_pagelist_fraction;
 extern int compat_log;
 extern int maps_protect;
 extern int sysctl_stat_interval;
-extern int audit_argv_kb;
 
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
 static int maxolduid = 65535;

@@ -347,16 +346,6 @@ static ctl_table kern_table[] = {
 		.mode		= 0644,
 		.proc_handler	= &proc_dointvec,
 	},
-#ifdef CONFIG_AUDITSYSCALL
-	{
-		.ctl_name	= CTL_UNNUMBERED,
-		.procname	= "audit_argv_kb",
-		.data		= &audit_argv_kb,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= &proc_dointvec,
-	},
-#endif
 	{
 		.ctl_name	= KERN_CORE_PATTERN,
 		.procname	= "core_pattern",