audit: implement container identifier

cover

	https://www.redhat.com/archives/linux-audit/2019-September/msg00052.html
  type=CONTAINER_ID msg=audit(2018-06-06 12:46:31.707:26953) : contid=123459
  type=PROCTITLE msg=audit(2018-06-06 12:46:31.707:26953) : proctitle=perl -e sleep 1; open(my $tmpfile, '>', "/tmp/tmpcontainerid"); close($tmpfile);
  type=PATH msg=audit(2018-06-06 12:46:31.707:26953) : item=1 name=/tmp/tmpcontainerid inode=25656 dev=00:26 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
  type=PATH msg=audit(2018-06-06 12:46:31.707:26953) : item=0 name=/tmp/ inode=8985 dev=00:26 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
  type=CWD msg=audit(2018-06-06 12:46:31.707:26953) : cwd=/root
  type=SYSCALL msg=audit(2018-06-06 12:46:31.707:26953) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffffffffffff9c a1=0x5621f2b81900 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=628 pid=2232 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=tmpcontainerid
  sleep 5 &
  child1=$!
  containerid1=123451
  echo $containerid1 > /proc/$child1/audit_containerid
  sleep 5 &
  child2=$!
  containerid2=123452
  echo $containerid2 > /proc/$child2/audit_containerid
  iptables -I INPUT -i lo -p icmp --icmp-type echo-request -j AUDIT --type accept
  iptables -I INPUT  -t mangle -i lo -p icmp --icmp-type echo-request -j MARK --set-mark 0x12345555
  sleep 1;
  bash -c "ping -q -c 1 127.0.0.1 >/dev/null 2>&1"
  sleep 1;
  ausearch -i -m NETFILTER_PKT -ts boot|grep mark=0x12345555
  ausearch -i -m NETFILTER_PKT -ts boot|grep contid=|grep $containerid1|grep $containerid2
 fs/proc/base.c              | 112 +++++++-
 include/linux/audit.h       | 135 +++++++++-
 include/linux/sched.h       |  10 +-
 include/uapi/linux/audit.h  |  10 +-
 init/init_task.c            |   3 +-
 init/main.c                 |   2 +
 kernel/audit.c              | 621 +++++++++++++++++++++++++++++++++++++++++++-
 kernel/audit.h              |  23 ++
 kernel/auditfilter.c        |  61 +++++
 kernel/auditsc.c            | 110 ++++++--
 kernel/fork.c               |   1 -
 kernel/nsproxy.c            |   4 +
 kernel/sched/core.c         |  33 +++
 net/netfilter/nft_log.c     |  11 +-
 net/netfilter/xt_AUDIT.c    |  11 +-
 security/selinux/nlmsgtab.c |   1 +
 security/yama/yama_lsm.c    |  33 ---
 17 files changed, 1085 insertions(+), 96 deletions(-)
1.8.3.1
---
 include/linux/audit.h | 49 +++++++++++++++++++++++------------
 include/linux/sched.h |  7 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/audit.c        | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--
 kernel/audit.h        |  5 ++++
 kernel/auditsc.c      | 26 ++++++++++---------
 kernel/fork.c         |  1 -
 8 files changed, 124 insertions(+), 40 deletions(-)
index 3fcd9ee49734..c2150415f9df 100644
@@ -100,6 +100,16 @@ enum audit_nfcfgop {
 	AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_task_info {
+	kuid_t			loginuid;
+	unsigned int		sessionid;
+#ifdef CONFIG_AUDITSYSCALL
+	struct audit_context	*ctx;
+#endif
+};
+
+extern struct audit_task_info init_struct_audit;
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

@@ -136,6 +146,9 @@ enum audit_nfcfgop {
 #ifdef CONFIG_AUDIT
 /* These are defined in audit.c */
 				/* Public API */
+extern int  audit_alloc(struct task_struct *task);
+extern void audit_free(struct task_struct *task);
+extern void __init audit_task_init(void);
 extern __printf(4, 5)
 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
 	       const char *fmt, ...);

@@ -179,12 +192,16 @@ extern void		    audit_log_path_denied(int type,
 
 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
 {
-	return tsk->loginuid;
+	if (!tsk->audit)
+		return INVALID_UID;
+	return tsk->audit->loginuid;
 }
 
 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 {
-	return tsk->sessionid;
+	if (!tsk->audit)
+		return AUDIT_SID_UNSET;
+	return tsk->audit->sessionid;
 }
 
 extern u32 audit_enabled;

@@ -192,6 +209,14 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 extern int audit_signal_info(int sig, struct task_struct *t);
 
 #else /* CONFIG_AUDIT */
+static inline int audit_alloc(struct task_struct *task)
+{
+	return 0;
+}
+static inline void audit_free(struct task_struct *task)
+{ }
+static inline void __init audit_task_init(void)
+{ }
 static inline __printf(4, 5)
 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
 	       const char *fmt, ...)

@@ -267,8 +292,6 @@ static inline int audit_signal_info(int sig, struct task_struct *t)
 
 /* These are defined in auditsc.c */
 				/* Public API */
-extern int  audit_alloc(struct task_struct *task);
-extern void __audit_free(struct task_struct *task);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
 				  unsigned long a2, unsigned long a3);
 extern void __audit_syscall_exit(int ret_success, long ret_value);

@@ -288,12 +311,14 @@ extern void audit_seccomp_actions_logged(const char *names,
 
 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx)
 {
-	task->audit_context = ctx;
+	task->audit->ctx = ctx;
 }
 
 static inline struct audit_context *audit_context(void)
 {
-	return current->audit_context;
+	if (!current->audit)
+		return NULL;
+	return current->audit->ctx;
 }
 
 static inline bool audit_dummy_context(void)

@@ -301,11 +326,7 @@ static inline bool audit_dummy_context(void)
 	void *p = audit_context();
 	return !p || *(int *)p;
 }
-static inline void audit_free(struct task_struct *task)
-{
-	if (unlikely(task->audit_context))
-		__audit_free(task);
-}
+
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)

@@ -533,12 +554,6 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 extern int audit_n_rules;
 extern int audit_signals;
 #else /* CONFIG_AUDITSYSCALL */
-static inline int audit_alloc(struct task_struct *task)
-{
-	return 0;
-}
-static inline void audit_free(struct task_struct *task)
-{ }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)

index b62e6aaf28f0..2213ac670386 100644
@@ -34,7 +34,6 @@
 #include <linux/kcsan.h>
 
 /* task_struct member predeclarations (sorted alphabetically): */
-struct audit_context;
 struct backing_dev_info;
 struct bio_list;
 struct blk_plug;

@@ -946,11 +945,7 @@ struct task_struct {
 	struct callback_head		*task_works;
 
 #ifdef CONFIG_AUDIT
-#ifdef CONFIG_AUDITSYSCALL
-	struct audit_context		*audit_context;
-#endif
-	kuid_t				loginuid;
-	unsigned int			sessionid;
+	struct audit_task_info		*audit;
 #endif
 	struct seccomp			seccomp;
 

index 15089d15010a..92d34c4b7702 100644
@@ -130,8 +130,7 @@ struct task_struct init_task
 	.thread_group	= LIST_HEAD_INIT(init_task.thread_group),
 	.thread_node	= LIST_HEAD_INIT(init_signals.thread_head),
 #ifdef CONFIG_AUDIT
-	.loginuid	= INVALID_UID,
-	.sessionid	= AUDIT_SID_UNSET,
+	.audit		= &init_struct_audit,
 #endif
 #ifdef CONFIG_PERF_EVENTS
 	.perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex),

index 0ead83e86b5a..349470ad7458 100644
@@ -96,6 +96,7 @@
 #include <linux/jump_label.h>
 #include <linux/mem_encrypt.h>
 #include <linux/kcsan.h>
+#include <linux/audit.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>

@@ -1028,6 +1029,7 @@ asmlinkage __visible void __init start_kernel(void)
 	nsfs_init();
 	cpuset_init();
 	cgroup_init();
+	audit_task_init();
 	taskstats_init_early();
 	delayacct_init();
 

index f0233dc40b17..9bee09757068 100644
@@ -251,6 +251,8 @@ extern void audit_log_d_path_exe(struct audit_buffer *ab,
 extern unsigned int audit_serial(void);
 extern int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial);
+extern int audit_alloc_syscall(struct task_struct *tsk);
+extern void audit_free_syscall(struct task_struct *tsk);
 
 extern void audit_put_watch(struct audit_watch *watch);
 extern void audit_get_watch(struct audit_watch *watch);

@@ -299,6 +301,9 @@ static inline void audit_clear_dummy(struct audit_context *ctx)
 
 #else /* CONFIG_AUDITSYSCALL */
 #define auditsc_get_stamp(c, t, s) 0
+#define audit_alloc_syscall(t) 0
+#define audit_free_syscall(t) {}
+
 #define audit_put_watch(w) {}
 #define audit_get_watch(w) {}
 #define audit_to_watch(k, p, l, o) (-EINVAL)

index 468a23390457..f00c1da587ea 100644
@@ -914,23 +914,25 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state)
 	return context;
 }
 
-/**
- * audit_alloc - allocate an audit context block for a task
+/*
+ * audit_alloc_syscall - allocate an audit context block for a task
  * @tsk: task
  *
  * Filter on the task information and allocate a per-task audit context
  * if necessary.  Doing so turns on system call auditing for the
- * specified task.  This is called from copy_process, so no lock is
- * needed.
+ * specified task.  This is called from copy_process via audit_alloc, so
+ * no lock is needed.
  */
-int audit_alloc(struct task_struct *tsk)
+int audit_alloc_syscall(struct task_struct *tsk)
 {
 	struct audit_context *context;
 	enum audit_state     state;
 	char *key = NULL;
 
-	if (likely(!audit_ever_enabled))
+	if (likely(!audit_ever_enabled)) {
+		audit_set_context(tsk, NULL);
 		return 0; /* Return if not auditing. */
+	}
 
 	state = audit_filter_task(tsk, &key);
 	if (state == AUDIT_DISABLED) {

@@ -940,7 +942,7 @@ int audit_alloc(struct task_struct *tsk)
 
 	if (!(context = audit_alloc_context(state))) {
 		kfree(key);
-		audit_log_lost("out of memory in audit_alloc");
+		audit_log_lost("out of memory in audit_alloc_syscall");
 		return -ENOMEM;
 	}
 	context->filterkey = key;

@@ -1582,14 +1584,15 @@ static void audit_log_exit(void)
 }
 
 /**
- * __audit_free - free a per-task audit context
+ * audit_free_syscall - free per-task audit context info
  * @tsk: task whose audit context block to free
  *
- * Called from copy_process and do_exit
+ * Called from audit_free
  */
-void __audit_free(struct task_struct *tsk)
+void audit_free_syscall(struct task_struct *tsk)
 {
-	struct audit_context *context = tsk->audit_context;
+	struct audit_task_info *info = tsk->audit;
+	struct audit_context *context = info->ctx;
 
 	if (!context)
 		return;

@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
 		if (context->current_state == AUDIT_RECORD_CONTEXT)
 			audit_log_exit();
 	}
-
 	audit_set_context(tsk, NULL);
 	audit_free_context(context);
 }

index 142b23645d82..bacbff0e8a75 100644
@@ -2019,7 +2019,6 @@ static __latent_entropy struct task_struct *copy_process(
 	posix_cputimers_init(&p->posix_cputimers);
 
 	p->io_context = NULL;
-	audit_set_context(p, NULL);
 	cgroup_fork(p);
 #ifdef CONFIG_NUMA
 	p->mempolicy = mpol_dup(p->mempolicy);

1.8.3.1
---
 fs/proc/base.c             |  36 +++++++++++
 include/linux/audit.h      |  33 ++++++++++
 include/uapi/linux/audit.h |   2 +
 kernel/audit.c             | 148 +++++++++++++++++++++++++++++++++++++++++++++
 kernel/audit.h             |   8 +++
 5 files changed, 227 insertions(+)
index d86c0afc8a85..6c17ab32e71b 100644
@@ -1317,6 +1317,40 @@ static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
 	.read		= proc_sessionid_read,
 	.llseek		= generic_file_llseek,
 };
+
+static ssize_t proc_contid_write(struct file *file, const char __user *buf,
+				   size_t count, loff_t *ppos)
+{
+	struct inode *inode = file_inode(file);
+	u64 contid;
+	int rv;
+	struct task_struct *task = get_proc_task(inode);
+
+	if (!task)
+		return -ESRCH;
+	if (*ppos != 0) {
+		/* No partial writes. */
+		put_task_struct(task);
+		return -EINVAL;
+	}
+
+	rv = kstrtou64_from_user(buf, count, 10, &contid);
+	if (rv < 0) {
+		put_task_struct(task);
+		return rv;
+	}
+
+	rv = audit_set_contid(task, contid);
+	put_task_struct(task);
+	if (rv < 0)
+		return rv;
+	return count;
+}
+
+static const struct file_operations proc_contid_operations = {
+	.write		= proc_contid_write,
+	.llseek		= generic_file_llseek,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION

@@ -3219,6 +3253,7 @@ static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns,
 #ifdef CONFIG_AUDIT
 	REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+	REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

@@ -3558,6 +3593,7 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
 #ifdef CONFIG_AUDIT
 	REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+	REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

index c2150415f9df..2800d4f1a2a8 100644
@@ -100,9 +100,18 @@ enum audit_nfcfgop {
 	AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_contobj {
+	struct list_head	list;
+	u64			id;
+	struct task_struct	*owner;
+	refcount_t		refcount;
+	struct rcu_head         rcu;
+};
+
 struct audit_task_info {
 	kuid_t			loginuid;
 	unsigned int		sessionid;
+	struct audit_contobj	*cont;
 #ifdef CONFIG_AUDITSYSCALL
 	struct audit_context	*ctx;
 #endif

@@ -204,6 +213,15 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 	return tsk->audit->sessionid;
 }
 
+extern int audit_set_contid(struct task_struct *tsk, u64 contid);
+
+static inline u64 audit_get_contid(struct task_struct *tsk)
+{
+	if (!tsk->audit || !tsk->audit->cont)
+		return AUDIT_CID_UNSET;
+	return tsk->audit->cont->id;
+}
+
 extern u32 audit_enabled;
 
 extern int audit_signal_info(int sig, struct task_struct *t);

@@ -268,6 +286,11 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 	return AUDIT_SID_UNSET;
 }
 
+static inline u64 audit_get_contid(struct task_struct *tsk)
+{
+	return AUDIT_CID_UNSET;
+}
+
 #define audit_enabled AUDIT_OFF
 
 static inline int audit_signal_info(int sig, struct task_struct *t)

@@ -692,6 +715,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk)
 	return uid_valid(audit_get_loginuid(tsk));
 }
 
+static inline bool audit_contid_valid(u64 contid)
+{
+	return contid != AUDIT_CID_UNSET;
+}
+
+static inline bool audit_contid_set(struct task_struct *tsk)
+{
+	return audit_contid_valid(audit_get_contid(tsk));
+}
+
 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
 {
 	audit_log_n_string(ab, buf, strlen(buf));

index 9b6a973f4cc3..859382527210 100644
@@ -71,6 +71,7 @@
 #define AUDIT_TTY_SET		1017	/* Set TTY auditing status */
 #define AUDIT_SET_FEATURE	1018	/* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE	1019	/* Get which features are enabled */
+#define AUDIT_CONTAINER_OP	1020	/* Define the container id and info */
 
 #define AUDIT_FIRST_USER_MSG	1100	/* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC		1107	/* We filter this differently */

@@ -491,6 +492,7 @@ struct audit_tty_status {
 
 #define AUDIT_UID_UNSET (unsigned int)-1
 #define AUDIT_SID_UNSET ((unsigned int)-1)
+#define AUDIT_CID_UNSET ((u64)-1)
 
 /* audit_rule_data supports filter rules with both integer and string
  * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and

index 9bee09757068..182fc76ea276 100644
@@ -210,6 +210,14 @@ static inline int audit_hash_ino(u32 ino)
 	return (ino & (AUDIT_INODE_BUCKETS-1));
 }
 
+#define AUDIT_CONTID_BUCKETS	32
+extern struct list_head audit_contid_hash[AUDIT_CONTID_BUCKETS];
+
+static inline int audit_hash_contid(u64 contid)
+{
+	return (contid & (AUDIT_CONTID_BUCKETS-1));
+}
+
 /* Indicates that audit should log the full pathname. */
 #define AUDIT_NAME_FULL -1
 

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 fs/proc/base.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)
index 6c17ab32e71b..794474cd8f35 100644
@@ -1234,7 +1234,7 @@ static ssize_t oom_score_adj_write(struct file *file, const char __user *buf,
 };
 
 #ifdef CONFIG_AUDIT
-#define TMPBUFLEN 11
+#define TMPBUFLEN 21
 static ssize_t proc_loginuid_read(struct file * file, char __user * buf,
 				  size_t count, loff_t *ppos)
 {

@@ -1318,6 +1318,24 @@ static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
 	.llseek		= generic_file_llseek,
 };
 
+static ssize_t proc_contid_read(struct file *file, char __user *buf,
+				  size_t count, loff_t *ppos)
+{
+	struct inode *inode = file_inode(file);
+	struct task_struct *task = get_proc_task(inode);
+	ssize_t length;
+	char tmpbuf[TMPBUFLEN];
+
+	if (!task)
+		return -ESRCH;
+	/* if we don't have caps, reject */
+	if (!capable(CAP_AUDIT_CONTROL))
+		return -EPERM;
+	length = scnprintf(tmpbuf, TMPBUFLEN, "%llu", audit_get_contid(task));
+	put_task_struct(task);
+	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
 static ssize_t proc_contid_write(struct file *file, const char __user *buf,
 				   size_t count, loff_t *ppos)
 {

@@ -1348,6 +1366,7 @@ static ssize_t proc_contid_write(struct file *file, const char __user *buf,
 }
 
 static const struct file_operations proc_contid_operations = {
+	.read		= proc_contid_read,
 	.write		= proc_contid_write,
 	.llseek		= generic_file_llseek,
 };

@@ -3253,7 +3272,7 @@ static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns,
 #ifdef CONFIG_AUDIT
 	REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
-	REG("audit_containerid", S_IWUSR, proc_contid_operations),
+	REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

@@ -3593,7 +3612,7 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
 #ifdef CONFIG_AUDIT
 	REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
-	REG("audit_containerid", S_IWUSR, proc_contid_operations),
+	REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 kernel/audit.c   | 20 ++++++++++++++++++++
 kernel/audit.h   |  2 ++
 kernel/auditsc.c |  2 ++
 3 files changed, 24 insertions(+)
index 6d387793f702..9e0b38ce1ead 100644
@@ -2558,6 +2558,26 @@ int audit_set_contid(struct task_struct *task, u64 contid)
 	return rc;
 }
 
+void audit_log_container_drop(void)
+{
+	struct audit_buffer *ab;
+	struct audit_contobj *cont;
+
+	rcu_read_lock();
+	cont = _audit_contobj_get(current);
+	_audit_contobj_put(cont);
+	if (!cont || refcount_read(&cont->refcount) > 1)
+		goto out;
+	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+	if (!ab)
+		goto out;
+	audit_log_format(ab, "op=drop opid=%d contid=%llu old-contid=%llu",
+			 task_tgid_nr(current), cont->id, cont->id);
+	audit_log_end(ab);
+out:
+	rcu_read_unlock();
+}
+
 /**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer

index 182fc76ea276..d07093903008 100644
@@ -254,6 +254,8 @@ extern void audit_log_d_path_exe(struct audit_buffer *ab,
 extern struct tty_struct *audit_get_tty(void);
 extern void audit_put_tty(struct tty_struct *tty);
 
+extern void audit_log_container_drop(void);
+
 /* audit watch/mark/tree functions */
 #ifdef CONFIG_AUDITSYSCALL
 extern unsigned int audit_serial(void);

index f00c1da587ea..f03d3eb0752c 100644
@@ -1575,6 +1575,8 @@ static void audit_log_exit(void)
 
 	audit_log_proctitle();
 
+	audit_log_container_drop();
+
 	/* Send end of event record to help user space know we are finished */
 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
 	if (ab)

1.8.3.1
---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 25 +++++++++++++++++++++++--
 kernel/audit.h             |  4 ++++
 kernel/auditsc.c           | 45 +++++++++++++++++++++++++++++++++++++++------
 5 files changed, 74 insertions(+), 8 deletions(-)
index 2800d4f1a2a8..5eeba0efffc2 100644
@@ -222,6 +222,9 @@ static inline u64 audit_get_contid(struct task_struct *tsk)
 	return tsk->audit->cont->id;
 }
 
+extern void audit_log_container_id(struct audit_context *context,
+				   struct audit_contobj *cont);
+
 extern u32 audit_enabled;
 
 extern int audit_signal_info(int sig, struct task_struct *t);

@@ -291,6 +294,10 @@ static inline u64 audit_get_contid(struct task_struct *tsk)
 	return AUDIT_CID_UNSET;
 }
 
+static inline void audit_log_container_id(struct audit_context *context,
+					  struct audit_contobj *cont)
+{ }
+
 #define audit_enabled AUDIT_OFF
 
 static inline int audit_signal_info(int sig, struct task_struct *t)

index 859382527210..fd98460c983f 100644
@@ -119,6 +119,7 @@
 #define AUDIT_TIME_ADJNTPVAL	1333	/* NTP value adjustment */
 #define AUDIT_BPF		1334	/* BPF subsystem */
 #define AUDIT_EVENT_LISTENER	1335	/* Task joined multicast read socket */
+#define AUDIT_CONTAINER_ID	1336	/* Container ID */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

index 9e0b38ce1ead..a09f8f661234 100644
@@ -227,7 +227,7 @@ static struct audit_contobj *_audit_contobj_hold(struct audit_contobj *cont)
 	return cont;
 }
 
-static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
+struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
 {
 	if (!tsk->audit)
 		return NULL;

@@ -235,7 +235,7 @@ static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
 }
 
 /* rcu_read_lock must be held by caller */
-static void _audit_contobj_put(struct audit_contobj *cont)
+void _audit_contobj_put(struct audit_contobj *cont)
 {
 	if (!cont)
 		return;

@@ -2211,6 +2211,27 @@ void audit_log_session_info(struct audit_buffer *ab)
 	audit_log_format(ab, "auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_container_id - report container info
+ * @context: task or local context for record
+ * @cont: container object to report
+ */
+void audit_log_container_id(struct audit_context *context,
+			    struct audit_contobj *cont)
+{
+	struct audit_buffer *ab;
+
+	if (!cont)
+		return;
+	/* Generate AUDIT_CONTAINER_ID record with container ID */
+	ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER_ID);
+	if (!ab)
+		return;
+	audit_log_format(ab, "contid=%llu", contid);
+	audit_log_end(ab);
+}
+EXPORT_SYMBOL(audit_log_container_id);
+
 void audit_log_key(struct audit_buffer *ab, char *key)
 {
 	audit_log_format(ab, " key=");

index d07093903008..0c9446f8d52c 100644
@@ -135,6 +135,7 @@ struct audit_context {
 	kuid_t		    target_uid;
 	unsigned int	    target_sessionid;
 	u32		    target_sid;
+	struct audit_contobj *target_cid;
 	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;

@@ -218,6 +219,9 @@ static inline int audit_hash_contid(u64 contid)
 	return (contid & (AUDIT_CONTID_BUCKETS-1));
 }
 
+extern struct audit_contobj *_audit_contobj_get(struct task_struct *tsk);
+extern void _audit_contobj_put(struct audit_contobj *cont);
+
 /* Indicates that audit should log the full pathname. */
 #define AUDIT_NAME_FULL -1
 

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/audit.h       |  8 ++++
 include/uapi/linux/audit.h  |  1 +
 kernel/audit.c              | 95 ++++++++++++++++++++++++++++++++++++++++++++-
 security/selinux/nlmsgtab.c |  1 +
 4 files changed, 104 insertions(+), 1 deletion(-)
index 5eeba0efffc2..89cf7c66abe6 100644
@@ -22,6 +22,13 @@ struct audit_sig_info {
 	char		ctx[];
 };
 
+struct audit_sig_info2 {
+	uid_t		uid;
+	pid_t		pid;
+	u32		cid_len;
+	char		data[];
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;

@@ -105,6 +112,7 @@ struct audit_contobj {
 	u64			id;
 	struct task_struct	*owner;
 	refcount_t		refcount;
+	refcount_t		sigflag;
 	struct rcu_head         rcu;
 };
 

index fd98460c983f..a56ad77069b9 100644
@@ -72,6 +72,7 @@
 #define AUDIT_SET_FEATURE	1018	/* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE	1019	/* Get which features are enabled */
 #define AUDIT_CONTAINER_OP	1020	/* Define the container id and info */
+#define AUDIT_SIGNAL_INFO2	1021	/* Get info auditd signal sender */
 
 #define AUDIT_FIRST_USER_MSG	1100	/* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC		1107	/* We filter this differently */

index b69231918686..8303bb7a63d0 100644
@@ -137,6 +137,7 @@ struct nlmsg_perm {
 	{ AUDIT_DEL_RULE,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
 	{ AUDIT_USER,		NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
 	{ AUDIT_SIGNAL_INFO,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+	{ AUDIT_SIGNAL_INFO2,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },
 	{ AUDIT_TRIM,		NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
 	{ AUDIT_MAKE_EQUIV,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
 	{ AUDIT_TTY_GET,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/audit.h |  8 ++++++++
 kernel/audit.h        |  1 +
 kernel/auditsc.c      | 33 ++++++++++++++++++++++++++++-----
 3 files changed, 37 insertions(+), 5 deletions(-)
index 89cf7c66abe6..15d0defc5193 100644
@@ -330,6 +330,8 @@ static inline int audit_signal_info(int sig, struct task_struct *t)
 
 /* These are defined in auditsc.c */
 				/* Public API */
+extern struct audit_context *audit_alloc_local(gfp_t gfpflags);
+extern void audit_free_context(struct audit_context *context);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
 				  unsigned long a2, unsigned long a3);
 extern void __audit_syscall_exit(int ret_success, long ret_value);

@@ -592,6 +594,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 extern int audit_n_rules;
 extern int audit_signals;
 #else /* CONFIG_AUDITSYSCALL */
+static inline struct audit_context *audit_alloc_local(gfp_t gfpflags)
+{
+	return NULL;
+}
+static inline void audit_free_context(struct audit_context *context)
+{ }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)

index 0c9446f8d52c..a7f88d76163f 100644
@@ -98,6 +98,7 @@ struct audit_proctitle {
 struct audit_context {
 	int		    dummy;	/* must be the first element */
 	int		    in_syscall;	/* 1 if task is in a syscall */
+	bool		    local;	/* local context needed */
 	enum audit_state    state, current_state;
 	unsigned int	    serial;     /* serial number for record */
 	int		    major;      /* syscall number */

index 9e79645e5c0e..935eb3d2cde9 100644
@@ -908,11 +908,13 @@ static inline void audit_free_aux(struct audit_context *context)
 	}
 }
 
-static inline struct audit_context *audit_alloc_context(enum audit_state state)
+static inline struct audit_context *audit_alloc_context(enum audit_state state,
+							gfp_t gfpflags)
 {
 	struct audit_context *context;
 
-	context = kzalloc(sizeof(*context), GFP_KERNEL);
+	/* We can be called in atomic context via audit_tg() */
+	context = kzalloc(sizeof(*context), gfpflags);
 	if (!context)
 		return NULL;
 	context->state = state;

@@ -948,7 +950,8 @@ int audit_alloc_syscall(struct task_struct *tsk)
 		return 0;
 	}
 
-	if (!(context = audit_alloc_context(state))) {
+	context = audit_alloc_context(state, GFP_KERNEL);
+	if (!context) {
 		kfree(key);
 		audit_log_lost("out of memory in audit_alloc_syscall");
 		return -ENOMEM;

@@ -960,8 +963,27 @@ int audit_alloc_syscall(struct task_struct *tsk)
 	return 0;
 }
 
-static inline void audit_free_context(struct audit_context *context)
+struct audit_context *audit_alloc_local(gfp_t gfpflags)
 {
+	struct audit_context *context = NULL;
+
+	context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags);
+	if (!context) {
+		audit_log_lost("out of memory in audit_alloc_local");
+		goto out;
+	}
+	context->serial = audit_serial();
+	ktime_get_coarse_real_ts64(&context->ctime);
+	context->local = true;
+out:
+	return context;
+}
+EXPORT_SYMBOL(audit_alloc_local);
+
+void audit_free_context(struct audit_context *context)
+{
+	if (!context)
+		return;
 	audit_free_module(context);
 	audit_free_names(context);
 	unroll_tree_refs(context, NULL, 0);

@@ -972,6 +994,7 @@ static inline void audit_free_context(struct audit_context *context)
 	audit_proctitle_free(context);
 	kfree(context);
 }
+EXPORT_SYMBOL(audit_free_context);
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
 				 kuid_t auid, kuid_t uid, unsigned int sessionid,

@@ -2204,7 +2227,7 @@ void __audit_inode_child(struct inode *parent,
 int auditsc_get_stamp(struct audit_context *ctx,
 		       struct timespec64 *t, unsigned int *serial)
 {
-	if (!ctx->in_syscall)
+	if (!ctx->in_syscall && !ctx->local)
 		return 0;
 	if (!ctx->serial)
 		ctx->serial = audit_serial();

1.8.3.1
---
 kernel/audit.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
index 54dd2cb69402..997c34178ee8 100644
@@ -1212,12 +1212,6 @@ static void audit_log_common_recv_msg(struct audit_context *context,
 	audit_log_task_context(*ab);
 }
 
-static inline void audit_log_user_recv_msg(struct audit_buffer **ab,
-					   u16 msg_type)
-{
-	audit_log_common_recv_msg(NULL, ab, msg_type);
-}
-
 int is_audit_feature_set(int i)
 {
 	return af.features & AUDIT_FEATURE_TO_MASK(i);

@@ -1486,6 +1480,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 		err = audit_filter(msg_type, AUDIT_FILTER_USER);
 		if (err == 1) { /* match or error */
 			char *str = data;
+			struct audit_context *context;
+			struct audit_contobj *cont;
 
 			err = 0;
 			if (msg_type == AUDIT_USER_TTY) {

@@ -1493,7 +1489,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 				if (err)
 					break;
 			}
-			audit_log_user_recv_msg(&ab, msg_type);
+			context = audit_alloc_local(GFP_KERNEL);
+			audit_log_common_recv_msg(context, &ab, msg_type);
 			if (msg_type != AUDIT_USER_TTY) {
 				/* ensure NULL termination */
 				str[data_len - 1] = '\0';

@@ -1507,6 +1504,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 				audit_log_n_untrustedstring(ab, str, data_len);
 			}
 			audit_log_end(ab);
+			rcu_read_lock();
+			cont = _audit_contobj_get(current);
+			rcu_read_unlock();
+			audit_log_container_id(context, cont);
+			rcu_read_lock();
+			_audit_contobj_put(cont);
+			rcu_read_unlock();
+			audit_free_context(context);
 		}
 		break;
 	case AUDIT_ADD_RULE:

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/audit.h      |  1 +
 include/uapi/linux/audit.h |  5 ++++-
 kernel/audit.h             |  1 +
 kernel/auditfilter.c       | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 kernel/auditsc.c           |  4 ++++
 5 files changed, 56 insertions(+), 1 deletion(-)
index 15d0defc5193..c4a755ae0d61 100644
@@ -68,6 +68,7 @@ struct audit_field {
 	u32				type;
 	union {
 		u32			val;
+		u64			val64;
 		kuid_t			uid;
 		kgid_t			gid;
 		struct {

index a56ad77069b9..831c12bdd235 100644
@@ -271,6 +271,7 @@
 #define AUDIT_LOGINUID_SET	24
 #define AUDIT_SESSIONID	25	/* Session ID */
 #define AUDIT_FSTYPE	26	/* FileSystem Type */
+#define AUDIT_CONTID	27	/* Container ID */
 
 				/* These are ONLY useful when checking
 				 * at syscall exit time (AUDIT_AT_EXIT). */

@@ -352,6 +353,7 @@ enum {
 #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER	0x00000010
 #define AUDIT_FEATURE_BITMAP_LOST_RESET		0x00000020
 #define AUDIT_FEATURE_BITMAP_FILTER_FS		0x00000040
+#define AUDIT_FEATURE_BITMAP_CONTAINERID	0x00000080
 
 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \
 				  AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \

@@ -359,7 +361,8 @@ enum {
 				  AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \
 				  AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \
 				  AUDIT_FEATURE_BITMAP_LOST_RESET | \
-				  AUDIT_FEATURE_BITMAP_FILTER_FS)
+				  AUDIT_FEATURE_BITMAP_FILTER_FS | \
+				  AUDIT_FEATURE_BITMAP_CONTAINERID)
 
 /* deprecated: AUDIT_VERSION_* */
 #define AUDIT_VERSION_LATEST 		AUDIT_FEATURE_BITMAP_ALL

index a7f88d76163f..34d8ec4bc6ef 100644
@@ -228,6 +228,7 @@ static inline int audit_hash_contid(u64 contid)
 
 extern int audit_match_class(int class, unsigned syscall);
 extern int audit_comparator(const u32 left, const u32 op, const u32 right);
+extern int audit_comparator64(const u64 left, const u32 op, const u64 right);
 extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right);
 extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right);
 extern int parent_len(const char *path);

index 935eb3d2cde9..baa5709590b4 100644
@@ -640,6 +640,10 @@ static int audit_filter_rules(struct task_struct *tsk,
 				result = audit_comparator(ctx->sockaddr->ss_family,
 							  f->op, f->val);
 			break;
+		case AUDIT_CONTID:
+			result = audit_comparator64(audit_get_contid(tsk),
+						    f->op, f->val64);
+			break;
 		case AUDIT_SUBJ_USER:
 		case AUDIT_SUBJ_ROLE:
 		case AUDIT_SUBJ_TYPE:

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/audit.h    |  20 ++++++
 kernel/audit.c           | 156 ++++++++++++++++++++++++++++++++++++++++++++++-
 kernel/nsproxy.c         |   4 ++
 net/netfilter/nft_log.c  |  11 +++-
 net/netfilter/xt_AUDIT.c |  11 +++-
 5 files changed, 195 insertions(+), 7 deletions(-)
index c4a755ae0d61..304fbb7c3c5b 100644
@@ -128,6 +128,13 @@ struct audit_task_info {
 
 extern struct audit_task_info init_struct_audit;
 
+struct audit_contobj_netns {
+	struct list_head	list;
+	struct audit_contobj	*obj;
+	int			count;
+	struct rcu_head		rcu;
+};
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

@@ -233,6 +240,11 @@ static inline u64 audit_get_contid(struct task_struct *tsk)
 
 extern void audit_log_container_id(struct audit_context *context,
 				   struct audit_contobj *cont);
+extern void audit_copy_namespaces(struct net *net, struct task_struct *tsk);
+extern void audit_switch_task_namespaces(struct nsproxy *ns,
+					 struct task_struct *p);
+extern void audit_log_netns_contid_list(struct net *net,
+					struct audit_context *context);
 
 extern u32 audit_enabled;
 

@@ -306,6 +318,14 @@ static inline u64 audit_get_contid(struct task_struct *tsk)
 static inline void audit_log_container_id(struct audit_context *context,
 					  struct audit_contobj *cont)
 { }
+static inline void audit_copy_namespaces(struct net *net, struct task_struct *tsk)
+{ }
+static inline void audit_switch_task_namespaces(struct nsproxy *ns,
+						struct task_struct *p)
+{ }
+static inline void audit_log_netns_contid_list(struct net *net,
+					       struct audit_context *context)
+{ }
 
 #define audit_enabled AUDIT_OFF
 

index b03df67621d0..5eddb3377049 100644
@@ -26,6 +26,7 @@
 #include <linux/syscalls.h>
 #include <linux/cgroup.h>
 #include <linux/perf_event.h>
+#include <linux/audit.h>
 
 static struct kmem_cache *nsproxy_cachep;
 

@@ -187,6 +188,8 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 	}
 
 	tsk->nsproxy = new_ns;
+	if (flags & CLONE_NEWNET)
+		audit_copy_namespaces(new_ns->net_ns, tsk);
 	return 0;
 }
 

@@ -249,6 +252,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
 	ns = p->nsproxy;
 	p->nsproxy = new;
 	task_unlock(p);
+	audit_switch_task_namespaces(ns, p);
 
 	if (ns && atomic_dec_and_test(&ns->count))
 		free_nsproxy(ns);

index fe4831f2258f..98d1e7e1a83c 100644
@@ -66,13 +66,16 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
 	struct sk_buff *skb = pkt->skb;
 	struct audit_buffer *ab;
 	int fam = -1;
+	struct audit_context *context;
+	struct net *net;
 
 	if (!audit_enabled)
 		return;
 
-	ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
+	context = audit_alloc_local(GFP_ATOMIC);
+	ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
 	if (!ab)
-		return;
+		goto errout;
 
 	audit_log_format(ab, "mark=%#x", skb->mark);
 

@@ -99,6 +102,10 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
 		audit_log_format(ab, " saddr=? daddr=? proto=-1");
 
 	audit_log_end(ab);
+	net = xt_net(&pkt->xt);
+	audit_log_netns_contid_list(net, context);
+errout:
+	audit_free_context(context);
 }
 
 static void nft_log_eval(const struct nft_expr *expr,

index 9cdc16b0d0d8..ecf868a1abde 100644
@@ -68,10 +68,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 {
 	struct audit_buffer *ab;
 	int fam = -1;
+	struct audit_context *context;
+	struct net *net;
 
 	if (audit_enabled == AUDIT_OFF)
-		goto errout;
-	ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
+		goto out;
+	context = audit_alloc_local(GFP_ATOMIC);
+	ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
 	if (ab == NULL)
 		goto errout;
 

@@ -101,7 +104,11 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 
 	audit_log_end(ab);
 
+	net = xt_net(par);
+	audit_log_netns_contid_list(net, context);
 errout:
+	audit_free_context(context);
+out:
 	return XT_CONTINUE;
 }
 

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/sched.h    |  3 +++
 kernel/audit.c           | 23 +++++++++++++++++++++--
 kernel/sched/core.c      | 33 +++++++++++++++++++++++++++++++++
 security/yama/yama_lsm.c | 33 ---------------------------------
 4 files changed, 57 insertions(+), 35 deletions(-)
index 2213ac670386..06938d0b9e0c 100644
@@ -2047,4 +2047,7 @@ static inline void rseq_syscall(struct pt_regs *regs)
 
 const struct cpumask *sched_trace_rd_span(struct root_domain *rd);
 
+extern int task_is_descendant(struct task_struct *parent,
+			      struct task_struct *child);
+
 #endif

index a862721dfd9b..efa65ec01239 100644
@@ -2713,6 +2713,20 @@ int audit_signal_info(int sig, struct task_struct *t)
 	return audit_signal_info_syscall(t);
 }
 
+static bool audit_contid_isnesting(struct task_struct *tsk)
+{
+	bool isowner = false;
+	bool ownerisparent = false;
+
+	rcu_read_lock();
+	if (tsk->audit && tsk->audit->cont) {
+		isowner = current == tsk->audit->cont->owner;
+		ownerisparent = task_is_descendant(tsk->audit->cont->owner, current);
+	}
+	rcu_read_unlock();
+	return !isowner && ownerisparent;
+}
+
 /*
  * audit_set_contid - set current task's audit contid
  * @task: target task

@@ -2755,8 +2769,13 @@ int audit_set_contid(struct task_struct *task, u64 contid)
 		rc = -EBUSY;
 		goto unlock;
 	}
-	/* if contid is already set, deny */
-	if (audit_contid_set(task))
+	/* if task is not descendant, block */
+	if (task == current || !task_is_descendant(current, task)) {
+		rc = -EXDEV;
+		goto unlock;
+	}
+	/* only allow contid setting again if nesting */
+	if (audit_contid_set(task) && !audit_contid_isnesting(task))
 		rc = -EEXIST;
 unlock:
 	read_unlock(&tasklist_lock);

index 8f360326861e..e6b24c52b3c3 100644
@@ -8012,6 +8012,39 @@ void dump_cpu_task(int cpu)
 }
 
 /*
+ * task_is_descendant - walk up a process family tree looking for a match
+ * @parent: the process to compare against while walking up from child
+ * @child: the process to start from while looking upwards for parent
+ *
+ * Returns 1 if child is a descendant of parent, 0 if not.
+ */
+int task_is_descendant(struct task_struct *parent,
+			      struct task_struct *child)
+{
+	int rc = 0;
+	struct task_struct *walker = child;
+
+	if (!parent || !child)
+		return 0;
+
+	rcu_read_lock();
+	if (!thread_group_leader(parent))
+		parent = rcu_dereference(parent->group_leader);
+	while (walker->pid > 0) {
+		if (!thread_group_leader(walker))
+			walker = rcu_dereference(walker->group_leader);
+		if (walker == parent) {
+			rc = 1;
+			break;
+		}
+		walker = rcu_dereference(walker->real_parent);
+	}
+	rcu_read_unlock();
+
+	return rc;
+}
+
+/*
  * Nice levels are multiplicative, with a gentle 10% change for every
  * nice level changed. I.e. when a CPU-bound task goes from nice 0 to
  * nice 1, it will get ~10% less CPU time than another CPU-bound task

index 536c99646f6a..24939f765df5 100644
@@ -263,39 +263,6 @@ static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 }
 
 /**
- * task_is_descendant - walk up a process family tree looking for a match
- * @parent: the process to compare against while walking up from child
- * @child: the process to start from while looking upwards for parent
- *
- * Returns 1 if child is a descendant of parent, 0 if not.
- */
-static int task_is_descendant(struct task_struct *parent,
-			      struct task_struct *child)
-{
-	int rc = 0;
-	struct task_struct *walker = child;
-
-	if (!parent || !child)
-		return 0;
-
-	rcu_read_lock();
-	if (!thread_group_leader(parent))
-		parent = rcu_dereference(parent->group_leader);
-	while (walker->pid > 0) {
-		if (!thread_group_leader(walker))
-			walker = rcu_dereference(walker->group_leader);
-		if (walker == parent) {
-			rc = 1;
-			break;
-		}
-		walker = rcu_dereference(walker->real_parent);
-	}
-	rcu_read_unlock();
-
-	return rc;
-}
-
-/**
  * ptracer_exception_found - tracer registered as exception for this tracee
  * @tracer: the task_struct of the process attempting ptrace
  * @tracee: the task_struct of the process to be ptraced

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 include/linux/audit.h |  1 +
 kernel/audit.c        | 60 ++++++++++++++++++++++++++++++++++++++++++---------
 kernel/audit.h        |  2 ++
 kernel/auditfilter.c  | 17 ++++++++++++++-
 kernel/auditsc.c      |  2 +-
 5 files changed, 70 insertions(+), 12 deletions(-)
index 304fbb7c3c5b..025b52ae8422 100644
@@ -115,6 +115,7 @@ struct audit_contobj {
 	refcount_t		refcount;
 	refcount_t		sigflag;
 	struct rcu_head         rcu;
+	struct audit_contobj	*parent;
 };
 
 struct audit_task_info {

index 34d8ec4bc6ef..7bea5b51124b 100644
@@ -229,6 +229,8 @@ static inline int audit_hash_contid(u64 contid)
 extern int audit_match_class(int class, unsigned syscall);
 extern int audit_comparator(const u32 left, const u32 op, const u32 right);
 extern int audit_comparator64(const u64 left, const u32 op, const u64 right);
+extern int audit_contid_comparator(const u64 left, const u32 op,
+				   const u64 right);
 extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right);
 extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right);
 extern int parent_len(const char *path);

index d812698efc1d..981c72a8b863 100644
@@ -1302,6 +1302,21 @@ int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
 	}
 }
 
+int audit_contid_comparator(u64 left, u32 op, u64 right)
+{
+	struct audit_contobj *cont = NULL;
+	int h;
+	int result = 0;
+
+	h = audit_hash_contid(left);
+	list_for_each_entry_rcu(cont, &audit_contid_hash[h], list) {
+		result = audit_comparator64(cont->id, op, right);
+		if (result)
+			break;
+	}
+	return result;
+}
+
 /**
  * parent_len - find the length of the parent portion of a pathname
  * @path: pathname of which to determine length

@@ -1393,7 +1408,7 @@ int audit_filter(int msgtype, unsigned int listtype)
 							  f->op, f->val);
 				break;
 			case AUDIT_CONTID:
-				result = audit_comparator64(audit_get_contid(current),
+				result = audit_contid_comparator(audit_get_contid(current),
 							    f->op, f->val64);
 				break;
 			case AUDIT_MSGTYPE:

index baa5709590b4..9198857ac721 100644
@@ -641,7 +641,7 @@ static int audit_filter_rules(struct task_struct *tsk,
 							  f->op, f->val);
 			break;
 		case AUDIT_CONTID:
-			result = audit_comparator64(audit_get_contid(tsk),
+			result = audit_contid_comparator(audit_get_contid(tsk),
 						    f->op, f->val64);
 			break;
 		case AUDIT_SUBJ_USER:

1.8.3.1

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
---
 fs/proc/base.c             | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 include/linux/audit.h      | 14 ++++++++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 38 ++++++++++++++++++++++++++++++-
 4 files changed, 108 insertions(+), 2 deletions(-)
index 794474cd8f35..1083db2ce345 100644
@@ -1329,7 +1329,7 @@ static ssize_t proc_contid_read(struct file *file, char __user *buf,
 	if (!task)
 		return -ESRCH;
 	/* if we don't have caps, reject */
-	if (!capable(CAP_AUDIT_CONTROL))
+	if (!capable(CAP_AUDIT_CONTROL) && !audit_get_capcontid(current))
 		return -EPERM;
 	length = scnprintf(tmpbuf, TMPBUFLEN, "%llu", audit_get_contid(task));
 	put_task_struct(task);

@@ -1370,6 +1370,59 @@ static ssize_t proc_contid_write(struct file *file, const char __user *buf,
 	.write		= proc_contid_write,
 	.llseek		= generic_file_llseek,
 };
+
+static ssize_t proc_capcontid_read(struct file *file, char __user *buf,
+				  size_t count, loff_t *ppos)
+{
+	struct inode *inode = file_inode(file);
+	struct task_struct *task = get_proc_task(inode);
+	ssize_t length;
+	char tmpbuf[TMPBUFLEN];
+
+	if (!task)
+		return -ESRCH;
+	/* if we don't have caps, reject */
+	if (!capable(CAP_AUDIT_CONTROL) && !audit_get_capcontid(current))
+		return -EPERM;
+	length = scnprintf(tmpbuf, TMPBUFLEN, "%u", audit_get_capcontid(task));
+	put_task_struct(task);
+	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
+static ssize_t proc_capcontid_write(struct file *file, const char __user *buf,
+				   size_t count, loff_t *ppos)
+{
+	struct inode *inode = file_inode(file);
+	u32 capcontid;
+	int rv;
+	struct task_struct *task = get_proc_task(inode);
+
+	if (!task)
+		return -ESRCH;
+	if (*ppos != 0) {
+		/* No partial writes. */
+		put_task_struct(task);
+		return -EINVAL;
+	}
+
+	rv = kstrtou32_from_user(buf, count, 10, &capcontid);
+	if (rv < 0) {
+		put_task_struct(task);
+		return rv;
+	}
+
+	rv = audit_set_capcontid(task, capcontid);
+	put_task_struct(task);
+	if (rv < 0)
+		return rv;
+	return count;
+}
+
+static const struct file_operations proc_capcontid_operations = {
+	.read		= proc_capcontid_read,
+	.write		= proc_capcontid_write,
+	.llseek		= generic_file_llseek,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION

@@ -3273,6 +3326,7 @@ static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns,
 	REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
 	REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations),
+	REG("audit_capcontainerid", S_IWUSR|S_IRUSR, proc_capcontid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

@@ -3613,6 +3667,7 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
 	REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
 	REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations),
+	REG("audit_capcontainerid", S_IWUSR|S_IRUSR, proc_capcontid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

index 025b52ae8422..2b3a2b6020ed 100644
@@ -122,6 +122,7 @@ struct audit_task_info {
 	kuid_t			loginuid;
 	unsigned int		sessionid;
 	struct audit_contobj	*cont;
+	u32			capcontid;
 #ifdef CONFIG_AUDITSYSCALL
 	struct audit_context	*ctx;
 #endif

@@ -230,6 +231,14 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 	return tsk->audit->sessionid;
 }
 
+static inline u32 audit_get_capcontid(struct task_struct *tsk)
+{
+	if (!tsk->audit)
+		return 0;
+	return tsk->audit->capcontid;
+}
+
+extern int audit_set_capcontid(struct task_struct *tsk, u32 enable);
 extern int audit_set_contid(struct task_struct *tsk, u64 contid);
 
 static inline u64 audit_get_contid(struct task_struct *tsk)

@@ -311,6 +320,11 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 	return AUDIT_SID_UNSET;
 }
 
+static inline u32 audit_get_capcontid(struct task_struct *tsk)
+{
+	return 0;
+}
+
 static inline u64 audit_get_contid(struct task_struct *tsk)
 {
 	return AUDIT_CID_UNSET;

index 831c12bdd235..5e30f4c95dc2 100644
@@ -73,6 +73,7 @@
 #define AUDIT_GET_FEATURE	1019	/* Get which features are enabled */
 #define AUDIT_CONTAINER_OP	1020	/* Define the container id and info */
 #define AUDIT_SIGNAL_INFO2	1021	/* Get info auditd signal sender */
+#define AUDIT_SET_CAPCONTID	1022	/* Set cap_contid of a task */
 
 #define AUDIT_FIRST_USER_MSG	1100	/* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC		1107	/* We filter this differently */

index aaf74702e993..454473f2e193 100644
@@ -307,6 +307,7 @@ int audit_alloc(struct task_struct *tsk)
 	rcu_read_lock();
 	info->cont = _audit_contobj_get(current);
 	rcu_read_unlock();
+	info->capcontid = 0;
 	tsk->audit = info;
 
 	ret = audit_alloc_syscall(tsk);

@@ -322,6 +323,7 @@ struct audit_task_info init_struct_audit = {
 	.loginuid = INVALID_UID,
 	.sessionid = AUDIT_SID_UNSET,
 	.cont = NULL,
+	.capcontid = 0,
 #ifdef CONFIG_AUDITSYSCALL
 	.ctx = NULL,
 #endif

@@ -2763,6 +2765,40 @@ static bool audit_contid_isnesting(struct task_struct *tsk)
 	return !isowner && ownerisparent;
 }
 
+int audit_set_capcontid(struct task_struct *task, u32 enable)
+{
+	u32 oldcapcontid;
+	int rc = 0;
+	struct audit_buffer *ab;
+
+	if (!task->audit)
+		return -ENOPROTOOPT;
+	oldcapcontid = audit_get_capcontid(task);
+	/* if task is not descendant, block */
+	if (task == current || !task_is_descendant(current, task))
+		rc = -EXDEV;
+	else if (current_user_ns() == &init_user_ns) {
+		if (!capable(CAP_AUDIT_CONTROL) &&
+		    !audit_get_capcontid(current))
+			rc = -EPERM;
+	}
+	if (!rc)
+		task->audit->capcontid = enable;
+
+	if (!audit_enabled)
+		return rc;
+
+	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SET_CAPCONTID);
+	if (!ab)
+		return rc;
+
+	audit_log_format(ab,
+			 "opid=%d capcontid=%u old-capcontid=%u",
+			 task_tgid_nr(task), enable, oldcapcontid);
+	audit_log_end(ab);
+	return rc;
+}
+
 /*
  * audit_set_contid - set current task's audit contid
  * @task: target task

@@ -2795,7 +2831,7 @@ int audit_set_contid(struct task_struct *task, u64 contid)
 		goto unlock;
 	}
 	/* if we don't have caps, reject */
-	if (!capable(CAP_AUDIT_CONTROL)) {
+	if (!capable(CAP_AUDIT_CONTROL) && !audit_get_capcontid(current)) {
 		rc = -EPERM;
 		goto unlock;
 	}

1.8.3.1
---
 fs/proc/base.c             |  36 +++++++++++
 include/linux/audit.h      |  33 ++++++++++
 include/uapi/linux/audit.h |   2 +
 kernel/audit.c             | 148 +++++++++++++++++++++++++++++++++++++++++++++
 kernel/audit.h             |   8 +++
 5 files changed, 227 insertions(+)
index d86c0afc8a85..6c17ab32e71b 100644
@@ -1317,6 +1317,40 @@ static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
        .read           = proc_sessionid_read,
        .llseek         = generic_file_llseek,
 };
+
+static ssize_t proc_contid_write(struct file *file, const char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+       struct inode *inode = file_inode(file);
+       u64 contid;
+       int rv;
+       struct task_struct *task = get_proc_task(inode);
+
+       if (!task)
+               return -ESRCH;
+       if (*ppos != 0) {
+               /* No partial writes. */
+               put_task_struct(task);
+               return -EINVAL;
+       }
+
+       rv = kstrtou64_from_user(buf, count, 10, &contid);
+       if (rv < 0) {
+               put_task_struct(task);
+               return rv;
+       }
+
+       rv = audit_set_contid(task, contid);
+       put_task_struct(task);
+       if (rv < 0)
+               return rv;
+       return count;
+}
+
+static const struct file_operations proc_contid_operations = {
+       .write          = proc_contid_write,
+       .llseek         = generic_file_llseek,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION

@@ -3219,6 +3253,7 @@ static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns,
 #ifdef CONFIG_AUDIT
        REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
        REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+       REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
        REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

@@ -3558,6 +3593,7 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
 #ifdef CONFIG_AUDIT
        REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
        REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+       REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
        REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

index c2150415f9df..2800d4f1a2a8 100644
@@ -100,9 +100,18 @@ enum audit_nfcfgop {
        AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_contobj {
+       struct list_head        list;
+       u64                     id;
+       struct task_struct      *owner;
+       refcount_t              refcount;
+       struct rcu_head         rcu;
+};
+
 struct audit_task_info {
        kuid_t                  loginuid;
        unsigned int            sessionid;
+       struct audit_contobj    *cont;
 #ifdef CONFIG_AUDITSYSCALL
        struct audit_context    *ctx;
 #endif

@@ -204,6 +213,15 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
        return tsk->audit->sessionid;
 }
 
+extern int audit_set_contid(struct task_struct *tsk, u64 contid);
+
+static inline u64 audit_get_contid(struct task_struct *tsk)
+{
+       if (!tsk->audit || !tsk->audit->cont)
+               return AUDIT_CID_UNSET;
+       return tsk->audit->cont->id;
+}
+
 extern u32 audit_enabled;
 
 extern int audit_signal_info(int sig, struct task_struct *t);

@@ -268,6 +286,11 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
        return AUDIT_SID_UNSET;
 }
 
+static inline u64 audit_get_contid(struct task_struct *tsk)
+{
+       return AUDIT_CID_UNSET;
+}
+
 #define audit_enabled AUDIT_OFF
 
 static inline int audit_signal_info(int sig, struct task_struct *t)

@@ -692,6 +715,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk)
        return uid_valid(audit_get_loginuid(tsk));
 }
 
+static inline bool audit_contid_valid(u64 contid)
+{
+       return contid != AUDIT_CID_UNSET;
+}
+
+static inline bool audit_contid_set(struct task_struct *tsk)
+{
+       return audit_contid_valid(audit_get_contid(tsk));
+}
+
 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
 {
        audit_log_n_string(ab, buf, strlen(buf));

index 9b6a973f4cc3..859382527210 100644
@@ -71,6 +71,7 @@
 #define AUDIT_TTY_SET          1017    /* Set TTY auditing status */
 #define AUDIT_SET_FEATURE      1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE      1019    /* Get which features are enabled */
+#define AUDIT_CONTAINER_OP     1020    /* Define the container id and info */
 
 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */

@@ -491,6 +492,7 @@ struct audit_tty_status {
 
 #define AUDIT_UID_UNSET (unsigned int)-1
 #define AUDIT_SID_UNSET ((unsigned int)-1)
+#define AUDIT_CID_UNSET ((u64)-1)
 
 /* audit_rule_data supports filter rules with both integer and string
  * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and

index 5d8147a29291..6d387793f702 100644
@@ -138,6 +138,13 @@ struct auditd_connection {
 
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
+/* Hash for contid object lists */
+struct list_head audit_contid_hash[AUDIT_CONTID_BUCKETS];
+/* Lock all additions and deletions to the contid hash lists, assignment
+ * of container objects to tasks.  There should be no need for
+ * interaction with tasklist_lock
+ */
+static DEFINE_SPINLOCK(audit_contobj_list_lock);
 
 static struct kmem_cache *audit_buffer_cache;
 

@@ -212,6 +219,33 @@ void __init audit_task_init(void)
                                             0, SLAB_PANIC, NULL);
 }
 
+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_hold(struct audit_contobj *cont)
+{
+       if (cont)
+               refcount_inc(&cont->refcount);
+       return cont;
+}
+
+static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
+{
+       if (!tsk->audit)
+               return NULL;
+       return _audit_contobj_hold(tsk->audit->cont);
+}
+
+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put(struct audit_contobj *cont)
+{
+       if (!cont)
+               return;
+       if (refcount_dec_and_test(&cont->refcount)) {
+               put_task_struct(cont->owner);
+               list_del_rcu(&cont->list);
+               kfree_rcu(cont, rcu);
+       }
+}
+
 /**
  * audit_alloc - allocate an audit info block for a task
  * @tsk: task

@@ -232,6 +266,9 @@ int audit_alloc(struct task_struct *tsk)
        }
        info->loginuid = audit_get_loginuid(current);
        info->sessionid = audit_get_sessionid(current);
+       rcu_read_lock();
+       info->cont = _audit_contobj_get(current);
+       rcu_read_unlock();
        tsk->audit = info;
 
        ret = audit_alloc_syscall(tsk);

@@ -246,6 +283,7 @@ int audit_alloc(struct task_struct *tsk)
 struct audit_task_info init_struct_audit = {
        .loginuid = INVALID_UID,
        .sessionid = AUDIT_SID_UNSET,
+       .cont = NULL,
 #ifdef CONFIG_AUDITSYSCALL
        .ctx = NULL,
 #endif

@@ -262,6 +300,9 @@ void audit_free(struct task_struct *tsk)
        struct audit_task_info *info = tsk->audit;
 
        audit_free_syscall(tsk);
+       rcu_read_lock();
+       _audit_contobj_put(tsk->audit->cont);
+       rcu_read_unlock();
        /* Freeing the audit_task_info struct must be performed after
         * audit_log_exit() due to need for loginuid and sessionid.
         */

@@ -1709,6 +1750,9 @@ static int __init audit_init(void)
        for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+       for (i = 0; i < AUDIT_CONTID_BUCKETS; i++)
+               INIT_LIST_HEAD(&audit_contid_hash[i]);
+
        mutex_init(&audit_cmd_mutex.lock);
        audit_cmd_mutex.owner = NULL;
 

@@ -2410,6 +2454,110 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }
 
+/*
+ * audit_set_contid - set current task's audit contid
+ * @task: target task
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * If the original container owner goes away, no task injection is
+ * possible to an existing container.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{
+       int rc = 0;
+       struct audit_buffer *ab;
+       struct audit_contobj *oldcont = NULL;
+
+       task_lock(task);
+       /* Can't set if audit disabled */
+       if (!task->audit) {
+               task_unlock(task);
+               return -ENOPROTOOPT;
+       }
+       read_lock(&tasklist_lock);
+       /* Don't allow the contid to be unset */
+       if (!audit_contid_valid(contid)) {
+               rc = -EINVAL;
+               goto unlock;
+       }
+       /* if we don't have caps, reject */
+       if (!capable(CAP_AUDIT_CONTROL)) {
+               rc = -EPERM;
+               goto unlock;
+       }
+       /* if task has children or is not single-threaded, deny */
+       if (!list_empty(&task->children) ||
+           !(thread_group_leader(task) && thread_group_empty(task))) {
+               rc = -EBUSY;
+               goto unlock;
+       }
+       /* if contid is already set, deny */
+       if (audit_contid_set(task))
+               rc = -EEXIST;
+unlock:
+       read_unlock(&tasklist_lock);
+       rcu_read_lock();
+       oldcont = _audit_contobj_get(task);
+       if (!rc) {
+               struct audit_contobj *cont = NULL, *newcont = NULL;
+               int h = audit_hash_contid(contid);
+
+               spin_lock(&audit_contobj_list_lock);
+               list_for_each_entry_rcu(cont, &audit_contid_hash[h], list)
+                       if (cont->id == contid) {
+                               /* task injection to existing container */
+                               if (current == cont->owner) {
+                                       _audit_contobj_hold(cont);
+                                       newcont = cont;
+                               } else {
+                                       rc = -ENOTUNIQ;
+                                       spin_unlock(&audit_contobj_list_lock);
+                                       goto conterror;
+                               }
+                               break;
+                       }
+               if (!newcont) {
+                       newcont = kmalloc(sizeof(*newcont), GFP_ATOMIC);
+                       if (newcont) {
+                               INIT_LIST_HEAD(&newcont->list);
+                               newcont->id = contid;
+                               newcont->owner = get_task_struct(current);
+                               refcount_set(&newcont->refcount, 1);
+                               list_add_rcu(&newcont->list,
+                                            &audit_contid_hash[h]);
+                       } else {
+                               rc = -ENOMEM;
+                               spin_unlock(&audit_contobj_list_lock);
+                               goto conterror;
+                       }
+               }
+               spin_unlock(&audit_contobj_list_lock);
+               task->audit->cont = newcont;
+               _audit_contobj_put(oldcont);
+       }
+conterror:
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       audit_log_format(ab,
+                        "op=set opid=%d contid=%llu old-contid=%llu",
+                        task_tgid_nr(task), contid, oldcont ? oldcont->id : -1);
+       _audit_contobj_put(oldcont);
+       rcu_read_unlock();
+       audit_log_end(ab);
+       return rc;
+}
+
 /**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer

index 9bee09757068..182fc76ea276 100644
@@ -210,6 +210,14 @@ static inline int audit_hash_ino(u32 ino)
        return (ino & (AUDIT_INODE_BUCKETS-1));
 }
 
+#define AUDIT_CONTID_BUCKETS   32
+extern struct list_head audit_contid_hash[AUDIT_CONTID_BUCKETS];
+
+static inline int audit_hash_contid(u64 contid)
+{
+       return (contid & (AUDIT_CONTID_BUCKETS-1));
+}
+
 /* Indicates that audit should log the full pathname. */
 #define AUDIT_NAME_FULL -1
 
--

paul moore
www.paul-moore.com
---
 include/linux/audit.h | 49 +++++++++++++++++++++++------------
 include/linux/sched.h |  7 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/audit.c        | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--
 kernel/audit.h        |  5 ++++
 kernel/auditsc.c      | 26 ++++++++++---------
 kernel/fork.c         |  1 -
 8 files changed, 124 insertions(+), 40 deletions(-)
index 3fcd9ee49734..c2150415f9df 100644
@@ -100,6 +100,16 @@ enum audit_nfcfgop {
        AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_task_info {
+       kuid_t                  loginuid;
+       unsigned int            sessionid;
+#ifdef CONFIG_AUDITSYSCALL
+       struct audit_context    *ctx;
+#endif
+};
+
+extern struct audit_task_info init_struct_audit;
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

index b62e6aaf28f0..2213ac670386 100644
@@ -34,7 +34,6 @@
 #include <linux/kcsan.h>
 
 /* task_struct member predeclarations (sorted alphabetically): */
-struct audit_context;
 struct backing_dev_info;
 struct bio_list;
 struct blk_plug;

@@ -946,11 +945,7 @@ struct task_struct {
        struct callback_head            *task_works;

 
 #ifdef CONFIG_AUDIT
-#ifdef CONFIG_AUDITSYSCALL
-       struct audit_context            *audit_context;
-#endif
-       kuid_t                          loginuid;
-       unsigned int                    sessionid;
+       struct audit_task_info          *audit;
 #endif
        struct seccomp                  seccomp;

index 15089d15010a..92d34c4b7702 100644
@@ -130,8 +130,7 @@ struct task_struct init_task
        .thread_group   = LIST_HEAD_INIT(init_task.thread_group),
        .thread_node    = LIST_HEAD_INIT(init_signals.thread_head),
 #ifdef CONFIG_AUDIT
-       .loginuid       = INVALID_UID,
-       .sessionid      = AUDIT_SID_UNSET,
+       .audit          = &init_struct_audit,
 #endif
 #ifdef CONFIG_PERF_EVENTS
        .perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex),

index 0ead83e86b5a..349470ad7458 100644
@@ -96,6 +96,7 @@
 #include <linux/jump_label.h>
 #include <linux/mem_encrypt.h>
 #include <linux/kcsan.h>
+#include <linux/audit.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>

@@ -1028,6 +1029,7 @@ asmlinkage __visible void __init start_kernel(void)
        nsfs_init();
        cpuset_init();
        cgroup_init();
+       audit_task_init();
        taskstats_init_early();
        delayacct_init();
 

index 8c201f414226..5d8147a29291 100644
@@ -203,6 +203,73 @@ struct audit_reply {
        struct sk_buff *skb;
 };
 
+static struct kmem_cache *audit_task_cache;
+
+void __init audit_task_init(void)
+{
+       audit_task_cache = kmem_cache_create("audit_task",
+                                            sizeof(struct audit_task_info),
+                                            0, SLAB_PANIC, NULL);
+}
+
+/**
+ * audit_alloc - allocate an audit info block for a task
+ * @tsk: task
+ *
+ * Call audit_alloc_syscall to filter on the task information and
+ * allocate a per-task audit context if necessary.  This is called from
+ * copy_process, so no lock is needed.
+ */
+int audit_alloc(struct task_struct *tsk)
+{
+       int ret = 0;
+       struct audit_task_info *info;
+
+       info = kmem_cache_alloc(audit_task_cache, GFP_KERNEL);
+       if (!info) {
+               ret = -ENOMEM;
+               goto out;
+       }
+       info->loginuid = audit_get_loginuid(current);
+       info->sessionid = audit_get_sessionid(current);

+       tsk->audit = info;
+
+       ret = audit_alloc_syscall(tsk);
+       if (ret) {
+               tsk->audit = NULL;
+               kmem_cache_free(audit_task_cache, info);
+       }
+out:
+       return ret;
+}

+struct audit_task_info init_struct_audit = {
+       .loginuid = INVALID_UID,
+       .sessionid = AUDIT_SID_UNSET,
+#ifdef CONFIG_AUDITSYSCALL
+       .ctx = NULL,
+#endif
+};
+
+/**
+ * audit_free - free per-task audit info
+ * @tsk: task whose audit info block to free
+ *
+ * Called from copy_process and do_exit
+ */
+void audit_free(struct task_struct *tsk)

+{
+       struct audit_task_info *info = tsk->audit;
+
+       audit_free_syscall(tsk);
+       /* Freeing the audit_task_info struct must be performed after
+        * audit_log_exit() due to need for loginuid and sessionid.
+        */
+       info = tsk->audit;
+       tsk->audit = NULL;
+       kmem_cache_free(audit_task_cache, info);

  audit_free_syscall(tsk);
  kmem_cache_free(audit_task_cache, tsk->audit);
  tsk->audit = NULL;
index 468a23390457..f00c1da587ea 100644
@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();
        }
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }

---
 fs/proc/base.c             |  36 +++++++++++
 include/linux/audit.h      |  33 ++++++++++
 include/uapi/linux/audit.h |   2 +
 kernel/audit.c             | 148 +++++++++++++++++++++++++++++++++++++++++++++
 kernel/audit.h             |   8 +++
 5 files changed, 227 insertions(+)
index c2150415f9df..2800d4f1a2a8 100644
@@ -692,6 +715,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk)
        return uid_valid(audit_get_loginuid(tsk));
 }

 
+static inline bool audit_contid_valid(u64 contid)
+{
+       return contid != AUDIT_CID_UNSET;
+}
+
+static inline bool audit_contid_set(struct task_struct *tsk)
+{
+       return audit_contid_valid(audit_get_contid(tsk));
+}

index 5d8147a29291..6d387793f702 100644
@@ -138,6 +138,13 @@ struct auditd_connection {
 
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
+/* Hash for contid object lists */
+struct list_head audit_contid_hash[AUDIT_CONTID_BUCKETS];
+/* Lock all additions and deletions to the contid hash lists, assignment
+ * of container objects to tasks.  There should be no need for
+ * interaction with tasklist_lock
+ */
+static DEFINE_SPINLOCK(audit_contobj_list_lock);
 
 static struct kmem_cache *audit_buffer_cache;
 

@@ -212,6 +219,33 @@ void __init audit_task_init(void)
                                             0, SLAB_PANIC, NULL);
 }
 
+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_hold(struct audit_contobj *cont)
+{
+       if (cont)
+               refcount_inc(&cont->refcount);
+       return cont;
+}
+
+static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
+{
+       if (!tsk->audit)
+               return NULL;
+       return _audit_contobj_hold(tsk->audit->cont);

+}
+
+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put(struct audit_contobj *cont)
+{
+       if (!cont)
+               return;
+       if (refcount_dec_and_test(&cont->refcount)) {
+               put_task_struct(cont->owner);
+               list_del_rcu(&cont->list);

+               kfree_rcu(cont, rcu);
+       }
+}

 /**
  * audit_alloc - allocate an audit info block for a task
  * @tsk: task

@@ -232,6 +266,9 @@ int audit_alloc(struct task_struct *tsk)
        }
        info->loginuid = audit_get_loginuid(current);
        info->sessionid = audit_get_sessionid(current);
+       rcu_read_lock();
+       info->cont = _audit_contobj_get(current);
+       rcu_read_unlock();

        tsk->audit = info;
 
        ret = audit_alloc_syscall(tsk);

@@ -246,6 +283,7 @@ int audit_alloc(struct task_struct *tsk)
 struct audit_task_info init_struct_audit = {
        .loginuid = INVALID_UID,
        .sessionid = AUDIT_SID_UNSET,
+       .cont = NULL,
 #ifdef CONFIG_AUDITSYSCALL
        .ctx = NULL,
 #endif

@@ -262,6 +300,9 @@ void audit_free(struct task_struct *tsk)
        struct audit_task_info *info = tsk->audit;
 
        audit_free_syscall(tsk);
+       rcu_read_lock();
+       _audit_contobj_put(tsk->audit->cont);
+       rcu_read_unlock();
        /* Freeing the audit_task_info struct must be performed after
         * audit_log_exit() due to need for loginuid and sessionid.
         */

@@ -1709,6 +1750,9 @@ static int __init audit_init(void)
        for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+       for (i = 0; i < AUDIT_CONTID_BUCKETS; i++)
+               INIT_LIST_HEAD(&audit_contid_hash[i]);
+
        mutex_init(&audit_cmd_mutex.lock);
        audit_cmd_mutex.owner = NULL;
 

@@ -2410,6 +2454,110 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }
 
+/*
+ * audit_set_contid - set current task's audit contid
+ * @task: target task
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * If the original container owner goes away, no task injection is
+ * possible to an existing container.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{

+       int rc = 0;
+       struct audit_buffer *ab;
+       struct audit_contobj *oldcont = NULL;
+
+       task_lock(task);
+       /* Can't set if audit disabled */
+       if (!task->audit) {
+               task_unlock(task);
+               return -ENOPROTOOPT;
+       }

+       read_lock(&tasklist_lock);
+       /* Don't allow the contid to be unset */
+       if (!audit_contid_valid(contid)) {
+               rc = -EINVAL;
+               goto unlock;
+       }
+       /* if we don't have caps, reject */
+       if (!capable(CAP_AUDIT_CONTROL)) {
+               rc = -EPERM;
+               goto unlock;
+       }

+       /* if task has children or is not single-threaded, deny */
+       if (!list_empty(&task->children) ||
+           !(thread_group_leader(task) && thread_group_empty(task))) {
+               rc = -EBUSY;
+               goto unlock;
+       }
+       /* if contid is already set, deny */
+       if (audit_contid_set(task))
+               rc = -EEXIST;
+unlock:

+       read_unlock(&tasklist_lock);
+       rcu_read_lock();
+       oldcont = _audit_contobj_get(task);
+       if (!rc) {
+               struct audit_contobj *cont = NULL, *newcont = NULL;
+               int h = audit_hash_contid(contid);
+
+               spin_lock(&audit_contobj_list_lock);
+               list_for_each_entry_rcu(cont, &audit_contid_hash[h], list)
+                       if (cont->id == contid) {
+                               /* task injection to existing container */
+                               if (current == cont->owner) {
+                                       _audit_contobj_hold(cont);
+                                       newcont = cont;
+                               } else {
+                                       rc = -ENOTUNIQ;
+                                       spin_unlock(&audit_contobj_list_lock);
+                                       goto conterror;
+                               }
+                               break;
+                       }
+               if (!newcont) {
+                       newcont = kmalloc(sizeof(*newcont), GFP_ATOMIC);
+                       if (newcont) {
+                               INIT_LIST_HEAD(&newcont->list);
+                               newcont->id = contid;
+                               newcont->owner = get_task_struct(current);
+                               refcount_set(&newcont->refcount, 1);
+                               list_add_rcu(&newcont->list,
+                                            &audit_contid_hash[h]);
+                       } else {
+                               rc = -ENOMEM;
+                               spin_unlock(&audit_contobj_list_lock);
+                               goto conterror;
+                       }
+               }
+               spin_unlock(&audit_contobj_list_lock);
+               task->audit->cont = newcont;
+               _audit_contobj_put(oldcont);
+       }
+conterror:
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)

+               return rc;
+
+       audit_log_format(ab,
+                        "op=set opid=%d contid=%llu old-contid=%llu",
+                        task_tgid_nr(task), contid, oldcont ? oldcont->id : -1);
+       _audit_contobj_put(oldcont);
+       rcu_read_unlock();
+       audit_log_end(ab);
+       return rc;
+}

---
 kernel/audit.c   | 20 ++++++++++++++++++++
 kernel/audit.h   |  2 ++
 kernel/auditsc.c |  2 ++
 3 files changed, 24 insertions(+)
index 6d387793f702..9e0b38ce1ead 100644
@@ -2558,6 +2558,26 @@ int audit_set_contid(struct task_struct *task, u64 contid)
        return rc;
 }
 
+void audit_log_container_drop(void)

+{
+       struct audit_buffer *ab;
+       struct audit_contobj *cont;
+
+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       _audit_contobj_put(cont);
+       if (!cont || refcount_read(&cont->refcount) > 1)
+               goto out;
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);

+       if (!ab)
+               goto out;
+       audit_log_format(ab, "op=drop opid=%d contid=%llu old-contid=%llu",
+                        task_tgid_nr(current), cont->id, cont->id);
+       audit_log_end(ab);
+out:
+       rcu_read_unlock();
+}
+
 /**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer

index 182fc76ea276..d07093903008 100644
@@ -254,6 +254,8 @@ extern void audit_log_d_path_exe(struct audit_buffer *ab,
 extern struct tty_struct *audit_get_tty(void);
 extern void audit_put_tty(struct tty_struct *tty);
 
+extern void audit_log_container_drop(void);
+
 /* audit watch/mark/tree functions */
 #ifdef CONFIG_AUDITSYSCALL
 extern unsigned int audit_serial(void);

index f00c1da587ea..f03d3eb0752c 100644

@@ -1575,6 +1575,8 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 
+       audit_log_container_drop();
+
        /* Send end of event record to help user space know we are finished */
        ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
        if (ab)

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 25 +++++++++++++++++++++++--
 kernel/audit.h             |  4 ++++
 kernel/auditsc.c           | 45 +++++++++++++++++++++++++++++++++++++++------
 5 files changed, 74 insertions(+), 8 deletions(-)
index 9e0b38ce1ead..a09f8f661234 100644
@@ -2211,6 +2211,27 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, "auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_container_id - report container info
+ * @context: task or local context for record
+ * @cont: container object to report
+ */
+void audit_log_container_id(struct audit_context *context,
+                           struct audit_contobj *cont)

+{
+       struct audit_buffer *ab;
+
+       if (!cont)
+               return;
+       /* Generate AUDIT_CONTAINER_ID record with container ID */
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER_ID);
+       if (!ab)
+               return;
+       audit_log_format(ab, "contid=%llu", contid);

index f03d3eb0752c..9e79645e5c0e 100644
@@ -1458,6 +1466,7 @@ static void audit_log_exit(void)
        struct audit_buffer *ab;
        struct audit_aux_data *aux;
        struct audit_names *n;
+       struct audit_contobj *cont;
 
        context->personality = current->personality;
 

@@ -1541,7 +1550,7 @@ static void audit_log_exit(void)
        for (aux = context->aux_pids; aux; aux = aux->next) {
                struct audit_aux_data_pids *axs = (void *)aux;
 
-               for (i = 0; i < axs->pid_count; i++)
+               for (i = 0; i < axs->pid_count; i++) {
                        if (audit_log_pid_context(context, axs->target_pid[i],
                                                  axs->target_auid[i],
                                                  axs->target_uid[i],

@@ -1549,14 +1558,20 @@ static void audit_log_exit(void)
                                                  axs->target_sid[i],
                                                  axs->target_comm[i]))
                                call_panic = 1;
+                       audit_log_container_id(context, axs->target_cid[i]);
+               }

        }
 
-       if (context->target_pid &&
-           audit_log_pid_context(context, context->target_pid,
-                                 context->target_auid, context->target_uid,
-                                 context->target_sessionid,
-                                 context->target_sid, context->target_comm))
+       if (context->target_pid) {
+               if (audit_log_pid_context(context, context->target_pid,
+                                         context->target_auid,
+                                         context->target_uid,
+                                         context->target_sessionid,
+                                         context->target_sid,
+                                         context->target_comm))
                        call_panic = 1;
+               audit_log_container_id(context, context->target_cid);
+       }
 
        if (context->pwd.dentry && context->pwd.mnt) {
                ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);

@@ -1575,6 +1590,14 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 
+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       rcu_read_unlock();
+       audit_log_container_id(context, cont);
+       rcu_read_lock();
+       _audit_contobj_put(cont);
+       rcu_read_unlock();

        audit_log_container_drop();
 
        /* Send end of event record to help user space know we are finished */

---
 include/linux/audit.h       |  8 ++++
 include/uapi/linux/audit.h  |  1 +
 kernel/audit.c              | 95 ++++++++++++++++++++++++++++++++++++++++++++-
 security/selinux/nlmsgtab.c |  1 +
 4 files changed, 104 insertions(+), 1 deletion(-)
index 5eeba0efffc2..89cf7c66abe6 100644
@@ -22,6 +22,13 @@ struct audit_sig_info {
        char            ctx[];
 };
 
+struct audit_sig_info2 {
+       uid_t           uid;
+       pid_t           pid;
+       u32             cid_len;
+       char            data[];
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;

@@ -105,6 +112,7 @@ struct audit_contobj {
        u64                     id;
        struct task_struct      *owner;
        refcount_t              refcount;
+       refcount_t              sigflag;
        struct rcu_head         rcu;
 };

index fd98460c983f..a56ad77069b9 100644
@@ -72,6 +72,7 @@
 #define AUDIT_SET_FEATURE      1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE      1019    /* Get which features are enabled */
 #define AUDIT_CONTAINER_OP     1020    /* Define the container id and info */
+#define AUDIT_SIGNAL_INFO2     1021    /* Get info auditd signal sender */
 
 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */

index a09f8f661234..54dd2cb69402 100644

@@ -126,6 +126,8 @@ struct auditd_connection {
 kuid_t         audit_sig_uid = INVALID_UID;
 pid_t          audit_sig_pid = -1;
 u32            audit_sig_sid = 0;
+static struct audit_contobj *audit_sig_cid;
+static struct task_struct *audit_sig_atsk;

 /* Records can be lost in several ways:
    0) [suppressed in audit_alloc]

@@ -239,7 +241,33 @@ void _audit_contobj_put(struct audit_contobj *cont)
 {
        if (!cont)
                return;
-       if (refcount_dec_and_test(&cont->refcount)) {
+       if (refcount_dec_and_test(&cont->refcount) && !refcount_read(&cont->sigflag)) {
+               put_task_struct(cont->owner);
+               list_del_rcu(&cont->list);
+               kfree_rcu(cont, rcu);
+       }
+}

+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_get_sig(struct task_struct *tsk)
+{
+       struct audit_contobj *cont;
+
+       if (!tsk->audit)
+               return NULL;
+       cont = tsk->audit->cont;
+       if (cont)
+               refcount_set(&cont->sigflag, 1);
+       return cont;
+}

+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put_sig(struct audit_contobj *cont)
+{
+       if (!cont)
+               return;
+       refcount_set(&cont->sigflag, 0);
+       if (!refcount_read(&cont->refcount)) {
                put_task_struct(cont->owner);
                list_del_rcu(&cont->list);
                kfree_rcu(cont, rcu);

@@ -309,6 +337,13 @@ void audit_free(struct task_struct *tsk)
        info = tsk->audit;
        tsk->audit = NULL;
        kmem_cache_free(audit_task_cache, info);
+       rcu_read_lock();
+       if (audit_sig_atsk == tsk) {
+               _audit_contobj_put_sig(audit_sig_cid);
+               audit_sig_cid = NULL;
+               audit_sig_atsk = NULL;
+       }
+       rcu_read_unlock();
 }
 
 /**

@@ -1132,6 +1167,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
        case AUDIT_ADD_RULE:
        case AUDIT_DEL_RULE:
        case AUDIT_SIGNAL_INFO:
+       case AUDIT_SIGNAL_INFO2:
        case AUDIT_TTY_GET:
        case AUDIT_TTY_SET:
        case AUDIT_TRIM:

@@ -1294,6 +1330,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct audit_buffer     *ab;
        u16                     msg_type = nlh->nlmsg_type;
        struct audit_sig_info   *sig_data;
+       struct audit_sig_info2  *sig_data2;
        char                    *ctx = NULL;
        u32                     len;
 

@@ -1559,6 +1596,52 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
                break;
+       case AUDIT_SIGNAL_INFO2: {
+               unsigned int contidstrlen = 0;
+
+               len = 0;
+               if (audit_sig_sid) {
+                       err = security_secid_to_secctx(audit_sig_sid, &ctx,
+                                                      &len);
+                       if (err)
+                               return err;
+               }
+               if (audit_sig_cid) {
+                       contidstr = kmalloc(21, GFP_KERNEL);
+                       if (!contidstr) {
+                               if (audit_sig_sid)
+                                       security_release_secctx(ctx, len);
+                               return -ENOMEM;
+                       }
+                       contidstrlen = scnprintf(contidstr, 20, "%llu", audit_sig_cid->id);
+               }
+               sig_data2 = kmalloc(sizeof(*sig_data2) + contidstrlen + len, GFP_KERNEL);
+               if (!sig_data2) {
+                       if (audit_sig_sid)
+                               security_release_secctx(ctx, len);
+                       kfree(contidstr);
+                       return -ENOMEM;
+               }
+               sig_data2->uid = from_kuid(&init_user_ns, audit_sig_uid);
+               sig_data2->pid = audit_sig_pid;
+               if (audit_sig_cid) {
+                       memcpy(sig_data2->data, contidstr, contidstrlen);

+                       sig_data2->cid_len = contidstrlen;
+                       kfree(contidstr);
+               }
+               if (audit_sig_sid) {
+                       memcpy(sig_data2->data + contidstrlen, ctx, len);
+                       security_release_secctx(ctx, len);
+               }
+               rcu_read_lock();
+               _audit_contobj_put_sig(audit_sig_cid);
+               rcu_read_unlock();

+               audit_sig_cid = NULL;
+               audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO2, 0, 0,
+                                sig_data2, sizeof(*sig_data2) + contidstrlen + len);
+               kfree(sig_data2);
+               break;
+       }
        case AUDIT_TTY_GET: {
                struct audit_tty_status s;
                unsigned int t;

@@ -2470,6 +2553,11 @@ int audit_signal_info(int sig, struct task_struct *t)
                else
                        audit_sig_uid = uid;
                security_task_getsecid(current, &audit_sig_sid);
+               rcu_read_lock();
+               _audit_contobj_put_sig(audit_sig_cid);
+               audit_sig_cid = _audit_contobj_get_sig(current);
+               rcu_read_unlock();
+               audit_sig_atsk = t;
        }
 
        return audit_signal_info_syscall(t);

@@ -2532,6 +2620,11 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                        if (cont->id == contid) {
                                /* task injection to existing container */
                                if (current == cont->owner) {
+                                       if (!refcount_read(&cont->refcount)) {
+                                               rc = -ESHUTDOWN;

+                                               spin_unlock(&audit_contobj_list_lock);
+                                               goto conterror;
+                                       }
                                        _audit_contobj_hold(cont);
                                        newcont = cont;
                                } else {

index b69231918686..8303bb7a63d0 100644

@@ -137,6 +137,7 @@ struct nlmsg_perm {
        { AUDIT_DEL_RULE,       NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
        { AUDIT_SIGNAL_INFO,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+       { AUDIT_SIGNAL_INFO2,   NETLINK_AUDIT_SOCKET__NLMSG_READ     },
        { AUDIT_TRIM,           NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_MAKE_EQUIV,     NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_TTY_GET,        NETLINK_AUDIT_SOCKET__NLMSG_READ     },

---
 include/linux/audit.h |  8 ++++++++
 kernel/audit.h        |  1 +
 kernel/auditsc.c      | 33 ++++++++++++++++++++++++++++-----
 3 files changed, 37 insertions(+), 5 deletions(-)
index 9e79645e5c0e..935eb3d2cde9 100644
@@ -908,11 +908,13 @@ static inline void audit_free_aux(struct audit_context *context)
        }

 }
 
-static inline struct audit_context *audit_alloc_context(enum audit_state state)
+static inline struct audit_context *audit_alloc_context(enum audit_state state,
+                                                       gfp_t gfpflags)
 {
        struct audit_context *context;
 
-       context = kzalloc(sizeof(*context), GFP_KERNEL);
+       /* We can be called in atomic context via audit_tg() */

@@ -960,8 +963,27 @@ int audit_alloc_syscall(struct task_struct *tsk)
        return 0;
 }
 
-static inline void audit_free_context(struct audit_context *context)
+struct audit_context *audit_alloc_local(gfp_t gfpflags)
 {
+       struct audit_context *context = NULL;
+
+       context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags);
+       if (!context) {
+               audit_log_lost("out of memory in audit_alloc_local");
+               goto out;

+       }
+       context->serial = audit_serial();
+       ktime_get_coarse_real_ts64(&context->ctime);
+       context->local = true;
+out:
+       return context;
+}
+EXPORT_SYMBOL(audit_alloc_local);

---
 kernel/audit.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
index 54dd2cb69402..997c34178ee8 100644
@@ -1507,6 +1504,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                audit_log_n_untrustedstring(ab, str, data_len);

                        }
                        audit_log_end(ab);
+                       rcu_read_lock();
+                       cont = _audit_contobj_get(current);
+                       rcu_read_unlock();
+                       audit_log_container_id(context, cont);
+                       rcu_read_lock();
+                       _audit_contobj_put(cont);
+                       rcu_read_unlock();
+                       audit_free_context(context);

---
 include/linux/audit.h    |  20 ++++++
 kernel/audit.c           | 156 ++++++++++++++++++++++++++++++++++++++++++++++-
 kernel/nsproxy.c         |   4 ++
 net/netfilter/nft_log.c  |  11 +++-
 net/netfilter/xt_AUDIT.c |  11 +++-
 5 files changed, 195 insertions(+), 7 deletions(-)
index c4a755ae0d61..304fbb7c3c5b 100644

@@ -128,6 +128,13 @@ struct audit_task_info {
 
 extern struct audit_task_info init_struct_audit;
 
+struct audit_contobj_netns {
+       struct list_head        list;
+       struct audit_contobj    *obj;
+       int                     count;

+       struct rcu_head         rcu;
+};

index 997c34178ee8..a862721dfd9b 100644
@@ -437,6 +452,136 @@ static struct sock *audit_get_sk(const struct net *net)
        return aunet->sk;
 }
 
+void audit_netns_contid_add(struct net *net, struct audit_contobj *cont)
+{
+       struct audit_net *aunet;
+       struct list_head *contobj_list;
+       struct audit_contobj_netns *contns;
+
+       if (!net)
+               return;
+       if (!cont)
+               return;
+       aunet = net_generic(net, audit_net_id);
+       if (!aunet)
+               return;
+       contobj_list = &aunet->contobj_list;
+       rcu_read_lock();
+       spin_lock(&aunet->contobj_list_lock);
+       list_for_each_entry_rcu(contns, contobj_list, list)
+               if (contns->obj == cont) {
+                       contns->count++;
+                       goto out;
+               }
+       contns = kmalloc(sizeof(*contns), GFP_ATOMIC);
+       if (contns) {
+               INIT_LIST_HEAD(&contns->list);
+               contns->obj = cont;
+               contns->count = 1;
+               list_add_rcu(&contns->list, contobj_list);
+       }
+out:
+       spin_unlock(&aunet->contobj_list_lock);
+       rcu_read_unlock();
+}
+
+void audit_netns_contid_del(struct net *net, struct audit_contobj *cont)
+{
+       struct audit_net *aunet;
+       struct list_head *contobj_list;
+       struct audit_contobj_netns *contns = NULL;
+
+       if (!net)
+               return;
+       if (!cont)
+               return;

+       aunet = net_generic(net, audit_net_id);
+       if (!aunet)
+               return;
+       contobj_list = &aunet->contobj_list;
+       rcu_read_lock();
+       spin_lock(&aunet->contobj_list_lock);
+       list_for_each_entry_rcu(contns, contobj_list, list)
+               if (contns->obj == cont) {
+                       contns->count--;
+                       if (contns->count < 1) {

+                               list_del_rcu(&contns->list);
+                               kfree_rcu(contns, rcu);
+                       }
+                       break;
+               }
+       spin_unlock(&aunet->contobj_list_lock);
+       rcu_read_unlock();
+}

---
 include/linux/sched.h    |  3 +++
 kernel/audit.c           | 23 +++++++++++++++++++++--
 kernel/sched/core.c      | 33 +++++++++++++++++++++++++++++++++
 security/yama/yama_lsm.c | 33 ---------------------------------
 4 files changed, 57 insertions(+), 35 deletions(-)
index 2213ac670386..06938d0b9e0c 100644
@@ -2047,4 +2047,7 @@ static inline void rseq_syscall(struct pt_regs *regs)
 
 const struct cpumask *sched_trace_rd_span(struct root_domain *rd);
 
+extern int task_is_descendant(struct task_struct *parent,
+                             struct task_struct *child);
+
 #endif

index a862721dfd9b..efa65ec01239 100644
@@ -2713,6 +2713,20 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }

 
+static bool audit_contid_isnesting(struct task_struct *tsk)
+{
+       bool isowner = false;
+       bool ownerisparent = false;
+
+       rcu_read_lock();
+       if (tsk->audit && tsk->audit->cont) {
+               isowner = current == tsk->audit->cont->owner;
+               ownerisparent = task_is_descendant(tsk->audit->cont->owner, current);

+       }
+       rcu_read_unlock();
+       return !isowner && ownerisparent;
+}
+
 /*
  * audit_set_contid - set current task's audit contid
  * @task: target task

@@ -2755,8 +2769,13 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                rc = -EBUSY;
                goto unlock;
        }
-       /* if contid is already set, deny */
-       if (audit_contid_set(task))
+       /* if task is not descendant, block */
+       if (task == current || !task_is_descendant(current, task)) {

+               rc = -EXDEV;

+               goto unlock;
+       }
+       /* only allow contid setting again if nesting */
+       if (audit_contid_set(task) && !audit_contid_isnesting(task))
                rc = -EEXIST;

    return -EACCESS;
      !ns_capable(current->nsproxy->user_ns, CAP_AUDIT_CONTROL))
    return -EPERM;
---
 include/linux/audit.h |  1 +
 kernel/audit.c        | 60 ++++++++++++++++++++++++++++++++++++++++++---------
 kernel/audit.h        |  2 ++
 kernel/auditfilter.c  | 17 ++++++++++++++-
 kernel/auditsc.c      |  2 +-
 5 files changed, 70 insertions(+), 12 deletions(-)
---
 fs/proc/base.c             | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 include/linux/audit.h      | 14 ++++++++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 38 ++++++++++++++++++++++++++++++-
 4 files changed, 108 insertions(+), 2 deletions(-)
---
 include/linux/audit.h | 49 +++++++++++++++++++++++------------
 include/linux/sched.h |  7 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/audit.c        | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--
 kernel/audit.h        |  5 ++++
 kernel/auditsc.c      | 26 ++++++++++---------
 kernel/fork.c         |  1 -
 8 files changed, 124 insertions(+), 40 deletions(-)
index 3fcd9ee49734..c2150415f9df 100644
@@ -100,6 +100,16 @@ enum audit_nfcfgop {
        AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_task_info {
+       kuid_t                  loginuid;
+       unsigned int            sessionid;
+#ifdef CONFIG_AUDITSYSCALL
+       struct audit_context    *ctx;
+#endif
+};
+
+extern struct audit_task_info init_struct_audit;
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

index b62e6aaf28f0..2213ac670386 100644
@@ -34,7 +34,6 @@
 #include <linux/kcsan.h>
 
 /* task_struct member predeclarations (sorted alphabetically): */
-struct audit_context;
 struct backing_dev_info;
 struct bio_list;
 struct blk_plug;

@@ -946,11 +945,7 @@ struct task_struct {
        struct callback_head            *task_works;

 
 #ifdef CONFIG_AUDIT
-#ifdef CONFIG_AUDITSYSCALL
-       struct audit_context            *audit_context;
-#endif
-       kuid_t                          loginuid;
-       unsigned int                    sessionid;
+       struct audit_task_info          *audit;
 #endif
        struct seccomp                  seccomp;

index 15089d15010a..92d34c4b7702 100644
@@ -130,8 +130,7 @@ struct task_struct init_task
        .thread_group   = LIST_HEAD_INIT(init_task.thread_group),
        .thread_node    = LIST_HEAD_INIT(init_signals.thread_head),
 #ifdef CONFIG_AUDIT
-       .loginuid       = INVALID_UID,
-       .sessionid      = AUDIT_SID_UNSET,
+       .audit          = &init_struct_audit,
 #endif
 #ifdef CONFIG_PERF_EVENTS
        .perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex),

index 0ead83e86b5a..349470ad7458 100644
@@ -96,6 +96,7 @@
 #include <linux/jump_label.h>
 #include <linux/mem_encrypt.h>
 #include <linux/kcsan.h>
+#include <linux/audit.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>

@@ -1028,6 +1029,7 @@ asmlinkage __visible void __init start_kernel(void)
        nsfs_init();
        cpuset_init();
        cgroup_init();
+       audit_task_init();
        taskstats_init_early();
        delayacct_init();
 

index 8c201f414226..5d8147a29291 100644
@@ -203,6 +203,73 @@ struct audit_reply {
        struct sk_buff *skb;
 };
 
+static struct kmem_cache *audit_task_cache;
+
+void __init audit_task_init(void)
+{
+       audit_task_cache = kmem_cache_create("audit_task",
+                                            sizeof(struct audit_task_info),
+                                            0, SLAB_PANIC, NULL);
+}
+
+/**
+ * audit_alloc - allocate an audit info block for a task
+ * @tsk: task
+ *
+ * Call audit_alloc_syscall to filter on the task information and
+ * allocate a per-task audit context if necessary.  This is called from
+ * copy_process, so no lock is needed.
+ */
+int audit_alloc(struct task_struct *tsk)
+{
+       int ret = 0;
+       struct audit_task_info *info;
+
+       info = kmem_cache_alloc(audit_task_cache, GFP_KERNEL);
+       if (!info) {
+               ret = -ENOMEM;
+               goto out;
+       }
+       info->loginuid = audit_get_loginuid(current);
+       info->sessionid = audit_get_sessionid(current);
+       tsk->audit = info;
+
+       ret = audit_alloc_syscall(tsk);
+       if (ret) {
+               tsk->audit = NULL;
+               kmem_cache_free(audit_task_cache, info);
+       }
+out:

+       return ret;
+}

+struct audit_task_info init_struct_audit = {
+       .loginuid = INVALID_UID,
+       .sessionid = AUDIT_SID_UNSET,
+#ifdef CONFIG_AUDITSYSCALL
+       .ctx = NULL,
+#endif
+};
+
+/**
+ * audit_free - free per-task audit info
+ * @tsk: task whose audit info block to free
+ *
+ * Called from copy_process and do_exit
+ */
+void audit_free(struct task_struct *tsk)
+{
+       struct audit_task_info *info = tsk->audit;
+
+       audit_free_syscall(tsk);
+       /* Freeing the audit_task_info struct must be performed after
+        * audit_log_exit() due to need for loginuid and sessionid.

+        */
+       info = tsk->audit;
+       tsk->audit = NULL;
+       kmem_cache_free(audit_task_cache, info);

  audit_free_syscall(tsk);
  kmem_cache_free(audit_task_cache, tsk->audit);
  tsk->audit = NULL;
index 468a23390457..f00c1da587ea 100644
@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();
        }
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }

---
 include/linux/audit.h | 49 +++++++++++++++++++++++------------
 include/linux/sched.h |  7 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/audit.c        | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--
 kernel/audit.h        |  5 ++++
 kernel/auditsc.c      | 26 ++++++++++---------
 kernel/fork.c         |  1 -
 8 files changed, 124 insertions(+), 40 deletions(-)
index 3fcd9ee49734..c2150415f9df 100644
@@ -100,6 +100,16 @@ enum audit_nfcfgop {
        AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_task_info {
+       kuid_t                  loginuid;
+       unsigned int            sessionid;
+#ifdef CONFIG_AUDITSYSCALL
+       struct audit_context    *ctx;
+#endif
+};
+
+extern struct audit_task_info init_struct_audit;
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

index b62e6aaf28f0..2213ac670386 100644
@@ -34,7 +34,6 @@
 #include <linux/kcsan.h>
 
 /* task_struct member predeclarations (sorted alphabetically): */
-struct audit_context;
 struct backing_dev_info;
 struct bio_list;
 struct blk_plug;

@@ -946,11 +945,7 @@ struct task_struct {
        struct callback_head            *task_works;

 
 #ifdef CONFIG_AUDIT
-#ifdef CONFIG_AUDITSYSCALL
-       struct audit_context            *audit_context;
-#endif
-       kuid_t                          loginuid;
-       unsigned int                    sessionid;
+       struct audit_task_info          *audit;
 #endif
        struct seccomp                  seccomp;

index 468a23390457..f00c1da587ea 100644
@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();

        }
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }

paul moore
www.paul-moore.com
---
 include/linux/audit.h | 49 +++++++++++++++++++++++------------
 include/linux/sched.h |  7 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/audit.c        | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--
 kernel/audit.h        |  5 ++++
 kernel/auditsc.c      | 26 ++++++++++---------
 kernel/fork.c         |  1 -
 8 files changed, 124 insertions(+), 40 deletions(-)
index 3fcd9ee49734..c2150415f9df 100644
@@ -100,6 +100,16 @@ enum audit_nfcfgop {
        AUDIT_XT_OP_UNREGISTER,
 };
 
+struct audit_task_info {
+       kuid_t                  loginuid;
+       unsigned int            sessionid;
+#ifdef CONFIG_AUDITSYSCALL
+       struct audit_context    *ctx;
+#endif
+};
+
+extern struct audit_task_info init_struct_audit;
+
 extern int is_audit_feature_set(int which);
 
 extern int __init audit_register_class(int class, unsigned *list);

index b62e6aaf28f0..2213ac670386 100644
@@ -34,7 +34,6 @@
 #include <linux/kcsan.h>
 
 /* task_struct member predeclarations (sorted alphabetically): */
-struct audit_context;
 struct backing_dev_info;
 struct bio_list;
 struct blk_plug;

@@ -946,11 +945,7 @@ struct task_struct {
        struct callback_head            *task_works;

 
 #ifdef CONFIG_AUDIT
-#ifdef CONFIG_AUDITSYSCALL
-       struct audit_context            *audit_context;
-#endif
-       kuid_t                          loginuid;
-       unsigned int                    sessionid;
+       struct audit_task_info          *audit;
 #endif
        struct seccomp                  seccomp;

	https://lkml.org/lkml/2018/4/18/759
	https://lkml.org/lkml/2018/5/12/173
		https://lkml.org/lkml/2018/5/12/168
	https://lkml.org/lkml/2018/5/16/461
		https://lkml.org/lkml/2018/5/16/457
index 468a23390457..f00c1da587ea 100644
@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();

        }
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }

        https://lkml.org/lkml/2018/4/18/759
index 468a23390457..f00c1da587ea 100644
@@ -1612,7 +1615,6 @@ void __audit_free(struct task_struct *tsk)
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();

        }
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }

paul moore
www.paul-moore.com
---
 kernel/audit.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
index 54dd2cb69402..997c34178ee8 100644
@@ -1507,6 +1504,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                audit_log_n_untrustedstring(ab, str, data_len);
                        }
                        audit_log_end(ab);
+                       rcu_read_lock();
+                       cont = _audit_contobj_get(current);
+                       rcu_read_unlock();
+                       audit_log_container_id(context, cont);

+                       rcu_read_lock();
+                       _audit_contobj_put(cont);
+                       rcu_read_unlock();
+                       audit_free_context(context);

---
 include/linux/audit.h    |  20 ++++++
 kernel/audit.c           | 156 ++++++++++++++++++++++++++++++++++++++++++++++-
 kernel/nsproxy.c         |   4 ++
 net/netfilter/nft_log.c  |  11 +++-
 net/netfilter/xt_AUDIT.c |  11 +++-
 5 files changed, 195 insertions(+), 7 deletions(-)
index c4a755ae0d61..304fbb7c3c5b 100644
@@ -128,6 +128,13 @@ struct audit_task_info {
 

 extern struct audit_task_info init_struct_audit;
 
+struct audit_contobj_netns {
+       struct list_head        list;
+       struct audit_contobj    *obj;
+       int                     count;

+       struct rcu_head         rcu;
+};

index 997c34178ee8..a862721dfd9b 100644
@@ -437,6 +452,136 @@ static struct sock *audit_get_sk(const struct net *net)
        return aunet->sk;
 }
 
+void audit_netns_contid_add(struct net *net, struct audit_contobj *cont)
+{
+       struct audit_net *aunet;
+       struct list_head *contobj_list;
+       struct audit_contobj_netns *contns;
+
+       if (!net)
+               return;
+       if (!cont)
+               return;
+       aunet = net_generic(net, audit_net_id);
+       if (!aunet)
+               return;
+       contobj_list = &aunet->contobj_list;
+       rcu_read_lock();
+       spin_lock(&aunet->contobj_list_lock);
+       list_for_each_entry_rcu(contns, contobj_list, list)
+               if (contns->obj == cont) {
+                       contns->count++;
+                       goto out;
+               }
+       contns = kmalloc(sizeof(*contns), GFP_ATOMIC);
+       if (contns) {
+               INIT_LIST_HEAD(&contns->list);
+               contns->obj = cont;
+               contns->count = 1;
+               list_add_rcu(&contns->list, contobj_list);
+       }
+out:
+       spin_unlock(&aunet->contobj_list_lock);
+       rcu_read_unlock();
+}
+
+void audit_netns_contid_del(struct net *net, struct audit_contobj *cont)
+{
+       struct audit_net *aunet;
+       struct list_head *contobj_list;
+       struct audit_contobj_netns *contns = NULL;
+
+       if (!net)
+               return;
+       if (!cont)
+               return;
+       aunet = net_generic(net, audit_net_id);
+       if (!aunet)
+               return;
+       contobj_list = &aunet->contobj_list;
+       rcu_read_lock();
+       spin_lock(&aunet->contobj_list_lock);

+       list_for_each_entry_rcu(contns, contobj_list, list)
+               if (contns->obj == cont) {
+                       contns->count--;
+                       if (contns->count < 1) {

+                               list_del_rcu(&contns->list);
+                               kfree_rcu(contns, rcu);
+                       }
+                       break;
+               }
+       spin_unlock(&aunet->contobj_list_lock);
+       rcu_read_unlock();
+}

---
 include/linux/audit.h       |  8 ++++
 include/uapi/linux/audit.h  |  1 +
 kernel/audit.c              | 95 ++++++++++++++++++++++++++++++++++++++++++++-
 security/selinux/nlmsgtab.c |  1 +
 4 files changed, 104 insertions(+), 1 deletion(-)
index 5eeba0efffc2..89cf7c66abe6 100644
@@ -22,6 +22,13 @@ struct audit_sig_info {
        char            ctx[];
 };
 
+struct audit_sig_info2 {
+       uid_t           uid;
+       pid_t           pid;
+       u32             cid_len;
+       char            data[];
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;

@@ -105,6 +112,7 @@ struct audit_contobj {
        u64                     id;
        struct task_struct      *owner;

        refcount_t              refcount;
+       refcount_t              sigflag;
        struct rcu_head         rcu;
 };

index fd98460c983f..a56ad77069b9 100644
@@ -72,6 +72,7 @@
 #define AUDIT_SET_FEATURE      1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE      1019    /* Get which features are enabled */
 #define AUDIT_CONTAINER_OP     1020    /* Define the container id and info */
+#define AUDIT_SIGNAL_INFO2     1021    /* Get info auditd signal sender */
 

 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */

index a09f8f661234..54dd2cb69402 100644
@@ -126,6 +126,8 @@ struct auditd_connection {
 kuid_t         audit_sig_uid = INVALID_UID;
 pid_t          audit_sig_pid = -1;
 u32            audit_sig_sid = 0;
+static struct audit_contobj *audit_sig_cid;
+static struct task_struct *audit_sig_atsk;

 /* Records can be lost in several ways:
    0) [suppressed in audit_alloc]

@@ -239,7 +241,33 @@ void _audit_contobj_put(struct audit_contobj *cont)
 {
        if (!cont)
                return;
-       if (refcount_dec_and_test(&cont->refcount)) {
+       if (refcount_dec_and_test(&cont->refcount) && !refcount_read(&cont->sigflag)) {
+               put_task_struct(cont->owner);

+               list_del_rcu(&cont->list);
+               kfree_rcu(cont, rcu);
+       }
+}

+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_get_sig(struct task_struct *tsk)
+{
+       struct audit_contobj *cont;
+
+       if (!tsk->audit)
+               return NULL;
+       cont = tsk->audit->cont;
+       if (cont)
+               refcount_set(&cont->sigflag, 1);

+       return cont;
+}

+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put_sig(struct audit_contobj *cont)
+{
+       if (!cont)
+               return;
+       refcount_set(&cont->sigflag, 0);
+       if (!refcount_read(&cont->refcount)) {
                put_task_struct(cont->owner);
                list_del_rcu(&cont->list);
                kfree_rcu(cont, rcu);

@@ -309,6 +337,13 @@ void audit_free(struct task_struct *tsk)
        info = tsk->audit;
        tsk->audit = NULL;
        kmem_cache_free(audit_task_cache, info);
+       rcu_read_lock();
+       if (audit_sig_atsk == tsk) {
+               _audit_contobj_put_sig(audit_sig_cid);
+               audit_sig_cid = NULL;
+               audit_sig_atsk = NULL;
+       }
+       rcu_read_unlock();
 }
 
 /**

@@ -1132,6 +1167,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
        case AUDIT_ADD_RULE:
        case AUDIT_DEL_RULE:
        case AUDIT_SIGNAL_INFO:
+       case AUDIT_SIGNAL_INFO2:
        case AUDIT_TTY_GET:
        case AUDIT_TTY_SET:
        case AUDIT_TRIM:

@@ -1294,6 +1330,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct audit_buffer     *ab;
        u16                     msg_type = nlh->nlmsg_type;
        struct audit_sig_info   *sig_data;
+       struct audit_sig_info2  *sig_data2;
        char                    *ctx = NULL;
        u32                     len;
 

@@ -1559,6 +1596,52 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
                break;
+       case AUDIT_SIGNAL_INFO2: {
+               unsigned int contidstrlen = 0;
+
+               len = 0;
+               if (audit_sig_sid) {
+                       err = security_secid_to_secctx(audit_sig_sid, &ctx,
+                                                      &len);
+                       if (err)
+                               return err;
+               }
+               if (audit_sig_cid) {
+                       contidstr = kmalloc(21, GFP_KERNEL);
+                       if (!contidstr) {
+                               if (audit_sig_sid)
+                                       security_release_secctx(ctx, len);
+                               return -ENOMEM;
+                       }
+                       contidstrlen = scnprintf(contidstr, 20, "%llu", audit_sig_cid->id);
+               }
+               sig_data2 = kmalloc(sizeof(*sig_data2) + contidstrlen + len, GFP_KERNEL);
+               if (!sig_data2) {
+                       if (audit_sig_sid)
+                               security_release_secctx(ctx, len);
+                       kfree(contidstr);
+                       return -ENOMEM;
+               }
+               sig_data2->uid = from_kuid(&init_user_ns, audit_sig_uid);
+               sig_data2->pid = audit_sig_pid;
+               if (audit_sig_cid) {
+                       memcpy(sig_data2->data, contidstr, contidstrlen);
+                       sig_data2->cid_len = contidstrlen;
+                       kfree(contidstr);
+               }
+               if (audit_sig_sid) {
+                       memcpy(sig_data2->data + contidstrlen, ctx, len);

+                       security_release_secctx(ctx, len);
+               }
+               rcu_read_lock();
+               _audit_contobj_put_sig(audit_sig_cid);
+               rcu_read_unlock();

+               audit_sig_cid = NULL;
+               audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO2, 0, 0,
+                                sig_data2, sizeof(*sig_data2) + contidstrlen + len);
+               kfree(sig_data2);
+               break;
+       }
        case AUDIT_TTY_GET: {
                struct audit_tty_status s;
                unsigned int t;

@@ -2470,6 +2553,11 @@ int audit_signal_info(int sig, struct task_struct *t)
                else
                        audit_sig_uid = uid;
                security_task_getsecid(current, &audit_sig_sid);
+               rcu_read_lock();
+               _audit_contobj_put_sig(audit_sig_cid);
+               audit_sig_cid = _audit_contobj_get_sig(current);
+               rcu_read_unlock();
+               audit_sig_atsk = t;
        }
 

        return audit_signal_info_syscall(t);

@@ -2532,6 +2620,11 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                        if (cont->id == contid) {
                                /* task injection to existing container */
                                if (current == cont->owner) {
+                                       if (!refcount_read(&cont->refcount)) {
+                                               rc = -ESHUTDOWN;

+                                               spin_unlock(&audit_contobj_list_lock);
+                                               goto conterror;
+                                       }
                                        _audit_contobj_hold(cont);
                                        newcont = cont;
                                } else {

index b69231918686..8303bb7a63d0 100644
@@ -137,6 +137,7 @@ struct nlmsg_perm {
        { AUDIT_DEL_RULE,       NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },

        { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
        { AUDIT_SIGNAL_INFO,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+       { AUDIT_SIGNAL_INFO2,   NETLINK_AUDIT_SOCKET__NLMSG_READ     },
        { AUDIT_TRIM,           NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_MAKE_EQUIV,     NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_TTY_GET,        NETLINK_AUDIT_SOCKET__NLMSG_READ     },

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 25 +++++++++++++++++++++++--
 kernel/audit.h             |  4 ++++
 kernel/auditsc.c           | 45 +++++++++++++++++++++++++++++++++++++++------
 5 files changed, 74 insertions(+), 8 deletions(-)
index 9e0b38ce1ead..a09f8f661234 100644
@@ -2211,6 +2211,27 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, "auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_container_id - report container info
+ * @context: task or local context for record
+ * @cont: container object to report
+ */
+void audit_log_container_id(struct audit_context *context,
+                           struct audit_contobj *cont)
+{
+       struct audit_buffer *ab;
+
+       if (!cont)
+               return;
+       /* Generate AUDIT_CONTAINER_ID record with container ID */
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER_ID);

+       if (!ab)
+               return;
+       audit_log_format(ab, "contid=%llu", contid);

index f03d3eb0752c..9e79645e5c0e 100644
@@ -1458,6 +1466,7 @@ static void audit_log_exit(void)
        struct audit_buffer *ab;
        struct audit_aux_data *aux;
        struct audit_names *n;
+       struct audit_contobj *cont;
 
        context->personality = current->personality;
 

@@ -1541,7 +1550,7 @@ static void audit_log_exit(void)
        for (aux = context->aux_pids; aux; aux = aux->next) {
                struct audit_aux_data_pids *axs = (void *)aux;
 

-               for (i = 0; i < axs->pid_count; i++)
+               for (i = 0; i < axs->pid_count; i++) {
                        if (audit_log_pid_context(context, axs->target_pid[i],
                                                  axs->target_auid[i],
                                                  axs->target_uid[i],

@@ -1549,14 +1558,20 @@ static void audit_log_exit(void)
                                                  axs->target_sid[i],
                                                  axs->target_comm[i]))
                                call_panic = 1;
+                       audit_log_container_id(context, axs->target_cid[i]);
+               }

        }
 
-       if (context->target_pid &&
-           audit_log_pid_context(context, context->target_pid,
-                                 context->target_auid, context->target_uid,
-                                 context->target_sessionid,
-                                 context->target_sid, context->target_comm))
+       if (context->target_pid) {
+               if (audit_log_pid_context(context, context->target_pid,
+                                         context->target_auid,
+                                         context->target_uid,
+                                         context->target_sessionid,
+                                         context->target_sid,
+                                         context->target_comm))
                        call_panic = 1;
+               audit_log_container_id(context, context->target_cid);
+       }
 
        if (context->pwd.dentry && context->pwd.mnt) {
                ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);

@@ -1575,6 +1590,14 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 

+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       rcu_read_unlock();
+       audit_log_container_id(context, cont);
+       rcu_read_lock();
+       _audit_contobj_put(cont);
+       rcu_read_unlock();

        audit_log_container_drop();
 
        /* Send end of event record to help user space know we are finished */

---
 fs/proc/base.c             |  36 +++++++++++
 include/linux/audit.h      |  33 ++++++++++
 include/uapi/linux/audit.h |   2 +
 kernel/audit.c             | 148 +++++++++++++++++++++++++++++++++++++++++++++
 kernel/audit.h             |   8 +++
 5 files changed, 227 insertions(+)
index c2150415f9df..2800d4f1a2a8 100644
@@ -692,6 +715,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk)
        return uid_valid(audit_get_loginuid(tsk));
 }
 

+static inline bool audit_contid_valid(u64 contid)
+{
+       return contid != AUDIT_CID_UNSET;
+}
+
+static inline bool audit_contid_set(struct task_struct *tsk)
+{
+       return audit_contid_valid(audit_get_contid(tsk));
+}

index 5d8147a29291..6d387793f702 100644
@@ -138,6 +138,13 @@ struct auditd_connection {
 
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
+/* Hash for contid object lists */
+struct list_head audit_contid_hash[AUDIT_CONTID_BUCKETS];
+/* Lock all additions and deletions to the contid hash lists, assignment
+ * of container objects to tasks.  There should be no need for
+ * interaction with tasklist_lock
+ */
+static DEFINE_SPINLOCK(audit_contobj_list_lock);
 
 static struct kmem_cache *audit_buffer_cache;
 

@@ -212,6 +219,33 @@ void __init audit_task_init(void)
                                             0, SLAB_PANIC, NULL);
 }
 
+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_hold(struct audit_contobj *cont)
+{
+       if (cont)
+               refcount_inc(&cont->refcount);
+       return cont;
+}
+
+static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
+{
+       if (!tsk->audit)
+               return NULL;
+       return _audit_contobj_hold(tsk->audit->cont);
+}
+
+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put(struct audit_contobj *cont)
+{
+       if (!cont)

+               return;
+       if (refcount_dec_and_test(&cont->refcount)) {
+               put_task_struct(cont->owner);
+               list_del_rcu(&cont->list);

+               kfree_rcu(cont, rcu);
+       }
+}

 /**
  * audit_alloc - allocate an audit info block for a task
  * @tsk: task

@@ -232,6 +266,9 @@ int audit_alloc(struct task_struct *tsk)
        }
        info->loginuid = audit_get_loginuid(current);

        info->sessionid = audit_get_sessionid(current);
+       rcu_read_lock();
+       info->cont = _audit_contobj_get(current);
+       rcu_read_unlock();

        tsk->audit = info;
 
        ret = audit_alloc_syscall(tsk);

@@ -246,6 +283,7 @@ int audit_alloc(struct task_struct *tsk)
 struct audit_task_info init_struct_audit = {
        .loginuid = INVALID_UID,
        .sessionid = AUDIT_SID_UNSET,
+       .cont = NULL,
 #ifdef CONFIG_AUDITSYSCALL
        .ctx = NULL,
 #endif

@@ -262,6 +300,9 @@ void audit_free(struct task_struct *tsk)
        struct audit_task_info *info = tsk->audit;
 
        audit_free_syscall(tsk);
+       rcu_read_lock();
+       _audit_contobj_put(tsk->audit->cont);
+       rcu_read_unlock();
        /* Freeing the audit_task_info struct must be performed after
         * audit_log_exit() due to need for loginuid and sessionid.
         */

@@ -1709,6 +1750,9 @@ static int __init audit_init(void)
        for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+       for (i = 0; i < AUDIT_CONTID_BUCKETS; i++)
+               INIT_LIST_HEAD(&audit_contid_hash[i]);
+
        mutex_init(&audit_cmd_mutex.lock);
        audit_cmd_mutex.owner = NULL;
 

@@ -2410,6 +2454,110 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }
 
+/*
+ * audit_set_contid - set current task's audit contid
+ * @task: target task
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * If the original container owner goes away, no task injection is
+ * possible to an existing container.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{

+       int rc = 0;
+       struct audit_buffer *ab;
+       struct audit_contobj *oldcont = NULL;
+
+       task_lock(task);
+       /* Can't set if audit disabled */
+       if (!task->audit) {
+               task_unlock(task);
+               return -ENOPROTOOPT;
+       }

+       read_lock(&tasklist_lock);
+       /* Don't allow the contid to be unset */
+       if (!audit_contid_valid(contid)) {
+               rc = -EINVAL;
+               goto unlock;
+       }
+       /* if we don't have caps, reject */
+       if (!capable(CAP_AUDIT_CONTROL)) {
+               rc = -EPERM;
+               goto unlock;
+       }

+       /* if task has children or is not single-threaded, deny */
+       if (!list_empty(&task->children) ||
+           !(thread_group_leader(task) && thread_group_empty(task))) {
+               rc = -EBUSY;
+               goto unlock;
+       }
+       /* if contid is already set, deny */
+       if (audit_contid_set(task))
+               rc = -EEXIST;
+unlock:

+       read_unlock(&tasklist_lock);
+       rcu_read_lock();
+       oldcont = _audit_contobj_get(task);
+       if (!rc) {
+               struct audit_contobj *cont = NULL, *newcont = NULL;
+               int h = audit_hash_contid(contid);
+
+               spin_lock(&audit_contobj_list_lock);
+               list_for_each_entry_rcu(cont, &audit_contid_hash[h], list)
+                       if (cont->id == contid) {
+                               /* task injection to existing container */
+                               if (current == cont->owner) {
+                                       _audit_contobj_hold(cont);
+                                       newcont = cont;
+                               } else {
+                                       rc = -ENOTUNIQ;
+                                       spin_unlock(&audit_contobj_list_lock);
+                                       goto conterror;
+                               }
+                               break;
+                       }
+               if (!newcont) {
+                       newcont = kmalloc(sizeof(*newcont), GFP_ATOMIC);
+                       if (newcont) {
+                               INIT_LIST_HEAD(&newcont->list);
+                               newcont->id = contid;
+                               newcont->owner = get_task_struct(current);
+                               refcount_set(&newcont->refcount, 1);
+                               list_add_rcu(&newcont->list,
+                                            &audit_contid_hash[h]);
+                       } else {
+                               rc = -ENOMEM;
+                               spin_unlock(&audit_contobj_list_lock);
+                               goto conterror;
+                       }
+               }
+               spin_unlock(&audit_contobj_list_lock);
+               task->audit->cont = newcont;
+               _audit_contobj_put(oldcont);
+       }
+conterror:
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       audit_log_format(ab,
+                        "op=set opid=%d contid=%llu old-contid=%llu",
+                        task_tgid_nr(task), contid, oldcont ? oldcont->id : -1);
+       _audit_contobj_put(oldcont);

+       rcu_read_unlock();
+       audit_log_end(ab);
+       return rc;
+}

---
 include/linux/sched.h    |  3 +++
 kernel/audit.c           | 23 +++++++++++++++++++++--
 kernel/sched/core.c      | 33 +++++++++++++++++++++++++++++++++
 security/yama/yama_lsm.c | 33 ---------------------------------
 4 files changed, 57 insertions(+), 35 deletions(-)
index 2213ac670386..06938d0b9e0c 100644
@@ -2047,4 +2047,7 @@ static inline void rseq_syscall(struct pt_regs *regs)
 
 const struct cpumask *sched_trace_rd_span(struct root_domain *rd);
 
+extern int task_is_descendant(struct task_struct *parent,
+                             struct task_struct *child);
+
 #endif

index a862721dfd9b..efa65ec01239 100644
@@ -2713,6 +2713,20 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }
 

+static bool audit_contid_isnesting(struct task_struct *tsk)
+{
+       bool isowner = false;
+       bool ownerisparent = false;
+
+       rcu_read_lock();
+       if (tsk->audit && tsk->audit->cont) {
+               isowner = current == tsk->audit->cont->owner;
+               ownerisparent = task_is_descendant(tsk->audit->cont->owner, current);

+       }
+       rcu_read_unlock();
+       return !isowner && ownerisparent;
+}
+
 /*
  * audit_set_contid - set current task's audit contid
  * @task: target task

@@ -2755,8 +2769,13 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                rc = -EBUSY;
                goto unlock;
        }
-       /* if contid is already set, deny */
-       if (audit_contid_set(task))

+       /* if task is not descendant, block */
+       if (task == current || !task_is_descendant(current, task)) {

+               rc = -EXDEV;

+               goto unlock;
+       }
+       /* only allow contid setting again if nesting */
+       if (audit_contid_set(task) && !audit_contid_isnesting(task))
                rc = -EEXIST;

  if ((current->audit->cont != tsk->audit->cont) || (current->audit->cont->owner != current))
    return -EACCESS;
      !ns_capable(current->nsproxy->user_ns, CAP_AUDIT_CONTROL))
    return -EPERM;
---
 kernel/audit.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
index 54dd2cb69402..997c34178ee8 100644
@@ -1507,6 +1504,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                audit_log_n_untrustedstring(ab, str, data_len);
                        }
                        audit_log_end(ab);
+                       rcu_read_lock();
+                       cont = _audit_contobj_get(current);
+                       rcu_read_unlock();
+                       audit_log_container_id(context, cont);

+                       rcu_read_lock();
+                       _audit_contobj_put(cont);
+                       rcu_read_unlock();
+                       audit_free_context(context);

paul moore
www.paul-moore.com
---
 include/linux/audit.h       |  8 ++++
 include/uapi/linux/audit.h  |  1 +
 kernel/audit.c              | 95 ++++++++++++++++++++++++++++++++++++++++++++-
 security/selinux/nlmsgtab.c |  1 +
 4 files changed, 104 insertions(+), 1 deletion(-)
index 5eeba0efffc2..89cf7c66abe6 100644
@@ -22,6 +22,13 @@ struct audit_sig_info {
        char            ctx[];
 };
 
+struct audit_sig_info2 {
+       uid_t           uid;
+       pid_t           pid;
+       u32             cid_len;
+       char            data[];
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;

@@ -105,6 +112,7 @@ struct audit_contobj {
        u64                     id;
        struct task_struct      *owner;

        refcount_t              refcount;
+       refcount_t              sigflag;
        struct rcu_head         rcu;
 };

index fd98460c983f..a56ad77069b9 100644
@@ -72,6 +72,7 @@
 #define AUDIT_SET_FEATURE      1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE      1019    /* Get which features are enabled */
 #define AUDIT_CONTAINER_OP     1020    /* Define the container id and info */
+#define AUDIT_SIGNAL_INFO2     1021    /* Get info auditd signal sender */
 

 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */

index a09f8f661234..54dd2cb69402 100644
@@ -126,6 +126,8 @@ struct auditd_connection {
 kuid_t         audit_sig_uid = INVALID_UID;
 pid_t          audit_sig_pid = -1;
 u32            audit_sig_sid = 0;
+static struct audit_contobj *audit_sig_cid;
+static struct task_struct *audit_sig_atsk;

@@ -2532,6 +2620,11 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                        if (cont->id == contid) {
                                /* task injection to existing container */
                                if (current == cont->owner) {
+                                       if (!refcount_read(&cont->refcount)) {
+                                               rc = -ESHUTDOWN;

paul moore
www.paul-moore.com
index f03d3eb0752c..9e79645e5c0e 100644
@@ -1458,6 +1466,7 @@ static void audit_log_exit(void)
        struct audit_buffer *ab;
        struct audit_aux_data *aux;
        struct audit_names *n;
+       struct audit_contobj *cont;
 
        context->personality = current->personality;
 

@@ -1541,7 +1550,7 @@ static void audit_log_exit(void)
        for (aux = context->aux_pids; aux; aux = aux->next) {
                struct audit_aux_data_pids *axs = (void *)aux;
 

-               for (i = 0; i < axs->pid_count; i++)
+               for (i = 0; i < axs->pid_count; i++) {
                        if (audit_log_pid_context(context, axs->target_pid[i],
                                                  axs->target_auid[i],
                                                  axs->target_uid[i],

@@ -1549,14 +1558,20 @@ static void audit_log_exit(void)
                                                  axs->target_sid[i],
                                                  axs->target_comm[i]))
                                call_panic = 1;
+                       audit_log_container_id(context, axs->target_cid[i]);
+               }

@@ -1575,6 +1590,14 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 

+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       rcu_read_unlock();
+       audit_log_container_id(context, cont);
+       rcu_read_lock();
+       _audit_contobj_put(cont);
+       rcu_read_unlock();

paul moore
www.paul-moore.com
@@ -212,6 +219,33 @@ void __init audit_task_init(void)
                                             0, SLAB_PANIC, NULL);
 }
 
+/* rcu_read_lock must be held by caller unless new */
+static struct audit_contobj *_audit_contobj_hold(struct audit_contobj *cont)
+{
+       if (cont)
+               refcount_inc(&cont->refcount);
+       return cont;
+}
+
+static struct audit_contobj *_audit_contobj_get(struct task_struct *tsk)
+{
+       if (!tsk->audit)
+               return NULL;
+       return _audit_contobj_hold(tsk->audit->cont);
+}
+
+/* rcu_read_lock must be held by caller */
+static void _audit_contobj_put(struct audit_contobj *cont)
+{
+       if (!cont)

+               return;
+       if (refcount_dec_and_test(&cont->refcount)) {
+               put_task_struct(cont->owner);
+               list_del_rcu(&cont->list);

+               kfree_rcu(cont, rcu);
+       }
+}

 /**
  * audit_alloc - allocate an audit info block for a task
  * @tsk: task

@@ -232,6 +266,9 @@ int audit_alloc(struct task_struct *tsk)
        }
        info->loginuid = audit_get_loginuid(current);

        info->sessionid = audit_get_sessionid(current);
+       rcu_read_lock();
+       info->cont = _audit_contobj_get(current);
+       rcu_read_unlock();

paul moore
www.paul-moore.com
paul moore
www.paul-moore.com
---
 include/linux/audit.h       |  8 ++++
 include/uapi/linux/audit.h  |  1 +
 kernel/audit.c              | 95 ++++++++++++++++++++++++++++++++++++++++++++-
 security/selinux/nlmsgtab.c |  1 +
 4 files changed, 104 insertions(+), 1 deletion(-)
index 5eeba0efffc2..89cf7c66abe6 100644
@@ -22,6 +22,13 @@ struct audit_sig_info {
        char            ctx[];
 };
 
+struct audit_sig_info2 {
+       uid_t           uid;
+       pid_t           pid;
+       u32             cid_len;
+       char            data[];
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;

@@ -105,6 +112,7 @@ struct audit_contobj {
        u64                     id;
        struct task_struct      *owner;
        refcount_t              refcount;
+       refcount_t              sigflag;
        struct rcu_head         rcu;
 };

index fd98460c983f..a56ad77069b9 100644
@@ -72,6 +72,7 @@
 #define AUDIT_SET_FEATURE      1018    /* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE      1019    /* Get which features are enabled */
 #define AUDIT_CONTAINER_OP     1020    /* Define the container id and info */
+#define AUDIT_SIGNAL_INFO2     1021    /* Get info auditd signal sender */
 
 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */

index a09f8f661234..54dd2cb69402 100644

@@ -126,6 +126,8 @@ struct auditd_connection {
 kuid_t         audit_sig_uid = INVALID_UID;
 pid_t          audit_sig_pid = -1;
 u32            audit_sig_sid = 0;
+static struct audit_contobj *audit_sig_cid;
+static struct task_struct *audit_sig_atsk;

@@ -2532,6 +2620,11 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                        if (cont->id == contid) {
                                /* task injection to existing container */
                                if (current == cont->owner) {
+                                       if (!refcount_read(&cont->refcount)) {
+                                               rc = -ESHUTDOWN;

index f03d3eb0752c..9e79645e5c0e 100644
@@ -1458,6 +1466,7 @@ static void audit_log_exit(void)
        struct audit_buffer *ab;
        struct audit_aux_data *aux;
        struct audit_names *n;
+       struct audit_contobj *cont;
 
        context->personality = current->personality;
 

@@ -1541,7 +1550,7 @@ static void audit_log_exit(void)
        for (aux = context->aux_pids; aux; aux = aux->next) {
                struct audit_aux_data_pids *axs = (void *)aux;
 

-               for (i = 0; i < axs->pid_count; i++)
+               for (i = 0; i < axs->pid_count; i++) {
                        if (audit_log_pid_context(context, axs->target_pid[i],
                                                  axs->target_auid[i],
                                                  axs->target_uid[i],

@@ -1549,14 +1558,20 @@ static void audit_log_exit(void)
                                                  axs->target_sid[i],
                                                  axs->target_comm[i]))
                                call_panic = 1;
+                       audit_log_container_id(context, axs->target_cid[i]);
+               }

@@ -1575,6 +1590,14 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 

+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       rcu_read_unlock();
+       audit_log_container_id(context, cont);
+       rcu_read_lock();
+       _audit_contobj_put(cont);
+       rcu_read_unlock();

index f03d3eb0752c..9e79645e5c0e 100644
@@ -1458,6 +1466,7 @@ static void audit_log_exit(void)
        struct audit_buffer *ab;
        struct audit_aux_data *aux;
        struct audit_names *n;
+       struct audit_contobj *cont;
 
        context->personality = current->personality;
 

@@ -1541,7 +1550,7 @@ static void audit_log_exit(void)
        for (aux = context->aux_pids; aux; aux = aux->next) {
                struct audit_aux_data_pids *axs = (void *)aux;
 

-               for (i = 0; i < axs->pid_count; i++)
+               for (i = 0; i < axs->pid_count; i++) {
                        if (audit_log_pid_context(context, axs->target_pid[i],
                                                  axs->target_auid[i],
                                                  axs->target_uid[i],

@@ -1549,14 +1558,20 @@ static void audit_log_exit(void)
                                                  axs->target_sid[i],
                                                  axs->target_comm[i]))
                                call_panic = 1;
+                       audit_log_container_id(context, axs->target_cid[i]);
+               }

@@ -1575,6 +1590,14 @@ static void audit_log_exit(void)
 
        audit_log_proctitle();
 

+       rcu_read_lock();
+       cont = _audit_contobj_get(current);
+       rcu_read_unlock();
+       audit_log_container_id(context, cont);
+       rcu_read_lock();
+       _audit_contobj_put(cont);
+       rcu_read_unlock();

paul moore
www.paul-moore.com
paul moore
www.paul-moore.com
_______________________________________________
Containers mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/containers