tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: apparmor4.0.0 [12/90]: LSM stacking v39: Audit: use an lsmblob in audit_names

Browse Source 
BugLink: http://bugs.launchpad.net/bugs/2028253

Replace the osid field in the audit_names structure with a
lsmblob structure. This accommodates the use of an lsmblob in
security_audit_rule_match() and security_inode_getsecid().

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
(cherry picked from commit a80f8c2737d32220bbaf44e14445209baa2429c4
https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
This commit is contained in:
Casey Schaufler
2023-08-29 15:34:45 -07:00
committed by Paolo Pisati
parent 78d2691d3f
commit 0f13719fe3
2 changed files with 6 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/audit.h
+1 -1
View File
@@ -82,7 +82,7 @@ struct audit_names {
kuid_t uid;
kgid_t gid;
dev_t rdev;
u32 osid;
struct lsmblob oblob;
struct audit_cap_data fcap;
unsigned int fcap_ver;
unsigned char type; /* record type */
kernel/auditsc.c
+5 -15
View File
@@ -698,19 +698,15 @@ static int audit_filter_rules(struct task_struct *tsk,
if (f->lsm_rule) {
/* Find files that match */
if (name) {
/* stacking scaffolding */
blob.scaffold.secid = name->osid;
result = security_audit_rule_match(
&blob,
&name->oblob,
f->type,
f->op,
f->lsm_rule);
} else if (ctx) {
list_for_each_entry(n, &ctx->names_list, list) {
/* stacking scaffolding */
blob.scaffold.secid = n->osid;
if (security_audit_rule_match(
&blob,
&n->oblob,
f->type,
f->op,
f->lsm_rule)) {
@@ -1562,13 +1558,11 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
from_kgid(&init_user_ns, n->gid),
MAJOR(n->rdev),
MINOR(n->rdev));
if (n->osid != 0) {
if (lsmblob_is_set(&n->oblob)) {
char *ctx = NULL;
u32 len;
if (security_secid_to_secctx(
n->osid, &ctx, &len)) {
audit_log_format(ab, " osid=%u", n->osid);
if (security_lsmblob_to_secctx(&n->oblob, &ctx, &len)) {
if (call_panic)
*call_panic = 2;
} else {
@@ -2276,17 +2270,13 @@ static void audit_copy_inode(struct audit_names *name,
const struct dentry *dentry,
struct inode *inode, unsigned int flags)
{
struct lsmblob blob;
name->ino = inode->i_ino;
name->dev = inode->i_sb->s_dev;
name->mode = inode->i_mode;
name->uid = inode->i_uid;
name->gid = inode->i_gid;
name->rdev = inode->i_rdev;
security_inode_getlsmblob(inode, &blob);
/* stacking scaffolding */
name->osid = blob.scaffold.secid;
security_inode_getlsmblob(inode, &name->oblob);
if (flags & AUDIT_INODE_NOEVAL) {
name->fcap_ver = -1;
return;