audit: Allow auditd to set pid to 0 to end auditing
PATCH 1/1 audit: Allow auditd to set pid to 0 to end auditing
The API to end auditing has historically been for auditd to set the pid to 0. This patch restores that functionality.
--- kernel/audit.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/audit.c +4 -3
@@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)pid_t auditd_pid;struct pid *req_pid =task_tgid (current); -/* sanity check - PID values must match */ -if (new_pid !=pid_vnr (req_pid)) +/* Sanity check - PID values must match. A 0 +* pid is how auditd normally ends auditing. */ +if (new_pid && (new_pid !=pid_vnr (req_pid)))return -EINVAL ;/* test the auditd connection */
@@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) auditd_pid =auditd_pid_vnr ();/* only the current auditd can unregister itself */ -if ((!new_pid) && (new_pid != auditd_pid)) { +if (new_pid && auditd_pid && (new_pid != auditd_pid)) {audit_log_config_change ("audit_pid" , new_pid, auditd_pid,0 );return -EACCES ;
Signature · 1 line
2.13.6
Quoted 2 lines · Steve Grubb
The API to end auditing has historically been for auditd to set the pid to 0. This patch restores that functionality.
Please include the issue number:
See: https://github.com/linux-audit/audit-kernel/issues/69
Quoted 1 line
Signed-off-by sgrubb <[email protected]>
Quoted 37 lines
--- kernel/audit.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)kernel/audit.c +4
-3@@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)pid_t auditd_pid;struct pid *req_pid =task_tgid (current); -/* sanity check - PID values must match */ -if (new_pid !=pid_vnr (req_pid)) +/* Sanity check - PID values must match. A 0 +* pid is how auditd normally ends auditing. */ +if (new_pid && (new_pid !=pid_vnr (req_pid)))return -EINVAL ;/* test the auditd connection */ @@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) auditd_pid =auditd_pid_vnr ();/* only the current auditd can unregister itself */ -if ((!new_pid) && (new_pid != auditd_pid)) { +if (new_pid && auditd_pid && (new_pid != auditd_pid)) {audit_log_config_change ("audit_pid" , new_pid, auditd_pid,0 );return -EACCES ;Signature · 7 lines
2.13.6 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
Paul Moore
maintainerQuoted 25 lines · Steve Grubb
The API to end auditing has historically been for auditd to set the pid to 0. This patch restores that functionality.
Signed-off-by sgrubb <[email protected]>--- kernel/audit.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)kernel/audit.c +3
-2@@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)pid_t auditd_pid;struct pid *req_pid =task_tgid (current); -/* sanity check - PID values must match */ -if (new_pid !=pid_vnr (req_pid)) +/* Sanity check - PID values must match. A 0 +* pid is how auditd normally ends auditing. */ +if (new_pid && (new_pid !=pid_vnr (req_pid)))return -EINVAL ;/* test the auditd connection */
kernel/audit.c static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) · line 1210
Quoted 5 lines
kernel/audit.c +1
-1@@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) auditd_pid =auditd_pid_vnr ();/* only the current auditd can unregister itself */ -if ((!new_pid) && (new_pid != auditd_pid)) { +if (new_pid && auditd_pid && (new_pid != auditd_pid)) {
The existing code is definitely not correct, but it looks like your proposed change is not correct either: the unnegated new_pid check at the start of the conditional is always going to be false in the disconnect case (new_pid == 0). I think the correct fix is something like below ...
if (auditd_pid && (!new_pid) && (pid_vnr(req_pid) != auditd_pid))
... and for bonus points, you could probably combine things a bit with the no-replace check driectly below that code for soemthing like this
...
if (auditd_pid) {
if ((!new_pid) && (pid_vnr(req_pid) != auditd_pid)) {
/* blah blah, you can't reset someone else's connection */
}
if (new_pid) {
/* blah blah, you can't replace a healthy connection */
}
}Signature · 2 lines
paul moore www.paul-moore.com