Skip to contentSkip to conversation

audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context

PATCH In review Oleg Nesterov 3 participants 4 messages Sep 15, 2013 – Sep 23, 2013 Audit

lore
Share & tools
lore

Oleg Nesterov

author
#0 lore raw

PATCH v2 1/1 audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context

Hello,

v2:
- update the changelog

- add the ack from Steve

Oleg.

author
#1 lore raw

PATCH v2 1/1 audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context

If audit_filter_task() nacks the new thread it makes sense to clear TIF_SYSCALL_AUDIT which can be copied from parent by dup_task_struct().

A wrong TIF_SYSCALL_AUDIT is not really bad but it triggers the "slow" audit paths in entry.S to ensure the task can not miss audit_syscall_*() calls, this is pointless if the task has no ->audit_context.

Signed-off-by Oleg Nesterov <[email protected]>
Acked-by Steve Grubb <[email protected]>
---
 kernel/auditsc.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
kernel/auditsc.c +3 -1
index 9845cb3..95293ab 100644
@@ -943,8 +943,10 @@ int audit_alloc(struct task_struct *tsk)
 		return 0; /* Return if not auditing. */
 
 	state = audit_filter_task(tsk, &key);
-	if (state == AUDIT_DISABLED)
+	if (state == AUDIT_DISABLED) {
+		clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
 		return 0;
+	}
 
 	if (!(context = audit_alloc_context(state))) {
 		kfree(key);
Signature · 1 line
1.5.5.1
maintainer Acked-by on v2 1/1
#2 lore raw
Quoted 11 lines · Oleg Nesterov

If audit_filter_task() nacks the new thread it makes sense to clear TIF_SYSCALL_AUDIT which can be copied from parent by dup_task_struct().

A wrong TIF_SYSCALL_AUDIT is not really bad but it triggers the "slow" audit paths in entry.S to ensure the task can not miss audit_syscall_*() calls, this is pointless if the task has no ->audit_context.

Signed-off-by Oleg Nesterov <[email protected]>
Acked-by Steve Grubb <[email protected]>
Acked-by Eric Paris <[email protected]>

Richard, please pick this up into your tree.

Quoted 20 lines
---
 kernel/auditsc.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
kernel/auditsc.c +3 -1
index 9845cb3..95293ab 100644
@@ -943,8 +943,10 @@ int audit_alloc(struct task_struct *tsk)
 		return 0; /* Return if not auditing. */
 
 	state = audit_filter_task(tsk, &key);
-	if (state == AUDIT_DISABLED)
+	if (state == AUDIT_DISABLED) {
+		clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
 		return 0;
+	}
 
 	if (!(context = audit_alloc_context(state))) {
 		kfree(key);
#3 lore raw
Quoted 10 lines · Eric Paris
Quoted 9 lines · Oleg Nesterov

If audit_filter_task() nacks the new thread it makes sense to clear TIF_SYSCALL_AUDIT which can be copied from parent by dup_task_struct().

A wrong TIF_SYSCALL_AUDIT is not really bad but it triggers the "slow" audit paths in entry.S to ensure the task can not miss audit_syscall_*() calls, this is pointless if the task has no ->audit_context.

Quoted 6 lines
Quoted 2 lines
Signed-off-by Oleg Nesterov <[email protected]>
Acked-by Steve Grubb <[email protected]>
Acked-by Eric Paris <[email protected]>

Richard, please pick this up into your tree.

Ack.

Quoted 18 lines
Quoted 18 lines
---
 kernel/auditsc.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
kernel/auditsc.c +3 -1
index 9845cb3..95293ab 100644
@@ -943,8 +943,10 @@ int audit_alloc(struct task_struct *tsk)
 		return 0; /* Return if not auditing. */
 
 	state = audit_filter_task(tsk, &key);
-	if (state == AUDIT_DISABLED)
+	if (state == AUDIT_DISABLED) {
+		clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
 		return 0;
+	}
Quoted 2 lines

kernel/auditsc.c int audit_alloc(struct task_struct *tsk) · line 952

Quoted 2 lines
kernel/auditsc.c +0 -0
 	if (!(context = audit_alloc_context(state))) {
 		kfree(key);

- RGB

--
Richard Guy Briggs <[email protected]>
Senior Software Engineer
Kernel Security
AMER ENG Base Operating Systems
Remote, Ottawa, Canada
Voice: +1.647.777.2635
Internal: (81) 32635
Alt: +1.613.693.0684x3545