Patch "audit: Allow auditd to set pid to 0 to end auditing" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Dec 15, 2017

Subsystems (2)

Stable branch Audit

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-12-15 08:01 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

audit: Allow auditd to set pid to 0 to end auditing

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
audit-allow-auditd-to-set-pid-to-0-to-end-auditing.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Tue Dec 12 10:32:42 CET 2017

From: Steve Grubb <[email protected]>
Date: Tue, 17 Oct 2017 18:29:22 -0400
Subject: audit: Allow auditd to set pid to 0 to end auditing

From: Steve Grubb <[email protected]>

[ Upstream commit 33e8a907804428109ce1d12301c3365d619cc4df ]

The API to end auditing has historically been for auditd to set the pid to 0. This patch restores that functionality.

See: https://github.com/linux-audit/audit-kernel/issues/69

Reviewed-by Richard Guy Briggs <[email protected]>

Signed-off-by Steve Grubb <[email protected]>

Signed-off-by Paul Moore <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/audit.c |   29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

kernel/audit.c +16 ~~-13~~

@@ -1197,25 +1197,28 @@ static int audit_receive_msg(struct sk_b
 			pid_t auditd_pid;
 			struct pid *req_pid = task_tgid(current);
 
-			/* sanity check - PID values must match */
-			if (new_pid != pid_vnr(req_pid))
+			/* Sanity check - PID values must match. Setting
+			 * pid to 0 is how auditd ends auditing. */
+			if (new_pid && (new_pid != pid_vnr(req_pid)))
 				return -EINVAL;
 
 			/* test the auditd connection */
 			audit_replace(req_pid);
 
 			auditd_pid = auditd_pid_vnr();
-			/* only the current auditd can unregister itself */
-			if ((!new_pid) && (new_pid != auditd_pid)) {
-				audit_log_config_change("audit_pid", new_pid,
-							auditd_pid, 0);
-				return -EACCES;
-			}
-			/* replacing a healthy auditd is not allowed */
-			if (auditd_pid && new_pid) {
-				audit_log_config_change("audit_pid", new_pid,
-							auditd_pid, 0);
-				return -EEXIST;
+			if (auditd_pid) {
+				/* replacing a healthy auditd is not allowed */
+				if (new_pid) {
+					audit_log_config_change("audit_pid",
+							new_pid, auditd_pid, 0);
+					return -EEXIST;
+				}
+				/* only current auditd can unregister itself */
+				if (pid_vnr(req_pid) != auditd_pid) {
+					audit_log_config_change("audit_pid",
+							new_pid, auditd_pid, 0);
+					return -EACCES;
+				}
 			}
 
 			if (new_pid) {

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/audit-allow-auditd-to-set-pid-to-0-to-end-auditing.patch