tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: apparmor4.0.0 [23/90]: LSM stacking v39: Audit: Allow multiple records in an audit_buffer

Browse Source 
BugLink: http://bugs.launchpad.net/bugs/2028253

Replace the single skb pointer in an audit_buffer with
a list of skb pointers. Add the audit_stamp information
to the audit_buffer as there's no guarantee that there
will be an audit_context containing the stamp associated
with the event. At audit_log_end() time create auxiliary
records (none are currently defined) as have been added
to the list. Functions are created to manage the skb list
in the audit_buffer.

Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
(cherry picked from commit f62c5b605a528afb9048fad5b2bfe5a1feb92638
https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
This commit is contained in:
Casey Schaufler
2023-08-18 07:58:33 -07:00
committed by Paolo Pisati
parent 341c97efe3
commit cf118c3c9a
1 changed files with 89 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/audit.c
+89 -22
View File
@@ -195,8 +195,10 @@ static struct audit_ctl_mutex {
* to place it on a transmit queue. Multiple audit_buffers can be in
* use simultaneously. */
struct audit_buffer {
struct sk_buff *skb; /* formatted skb ready to send */
struct sk_buff *skb; /* the skb for audit_log functions */
struct sk_buff_head skb_list; /* formatted skbs, ready to send */
struct audit_context *ctx; /* NULL or associated context */
struct audit_stamp stamp; /* audit stamp for these records */
gfp_t gfp_mask;
};
@@ -1780,10 +1782,13 @@ __setup("audit_backlog_limit=", audit_backlog_limit_set);
static void audit_buffer_free(struct audit_buffer *ab)
{
struct sk_buff *skb;
if (!ab)
return;
kfree_skb(ab->skb);
while ((skb = skb_dequeue(&ab->skb_list)))
kfree_skb(skb);
kmem_cache_free(audit_buffer_cache, ab);
}
@@ -1799,6 +1804,10 @@ static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx,
ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
if (!ab->skb)
goto err;
skb_queue_head_init(&ab->skb_list);
skb_queue_tail(&ab->skb_list, ab->skb);
if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
goto err;
@@ -1864,7 +1873,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
int type)
{
struct audit_buffer *ab;
struct audit_stamp stamp;
if (audit_initialized != AUDIT_INITIALIZED)
return NULL;
@@ -1919,14 +1927,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
return NULL;
}
audit_get_stamp(ab->ctx, &stamp);
audit_get_stamp(ab->ctx, &ab->stamp);
/* cancel dummy context to enable supporting records */
if (ctx)
ctx->dummy = 0;
audit_log_format(ab, "audit(%llu.%03lu:%u): ",
(unsigned long long)stamp.ctime.tv_sec,
stamp.ctime.tv_nsec/1000000,
stamp.serial);
(unsigned long long)ab->stamp.ctime.tv_sec,
ab->stamp.ctime.tv_nsec/1000000,
ab->stamp.serial);
return ab;
}
@@ -2182,6 +2190,57 @@ void audit_log_key(struct audit_buffer *ab, char *key)
audit_log_format(ab, "(null)");
}
/**
* audit_buffer_aux_new - Add an aux record buffer to the skb list
* @ab: audit_buffer
* @type: message type
*
* Aux records are allocated and added to the skb list of
* the "main" record. The ab->skb is reset to point to the
* aux record on its creation. When the aux record in complete
* ab->skb has to be reset to point to the "main" record.
* This allows the audit_log_ functions to be ignorant of
* which kind of record it is logging to. It also avoids adding
* special data for aux records.
*
* On success ab->skb will point to the new aux record.
* Returns 0 on success, -ENOMEM should allocation fail.
*/
static int audit_buffer_aux_new(struct audit_buffer *ab, int type)
{
WARN_ON(ab->skb != skb_peek(&ab->skb_list));
ab->skb = nlmsg_new(AUDIT_BUFSIZ, ab->gfp_mask);
if (!ab->skb)
goto err;
if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
goto err;
skb_queue_tail(&ab->skb_list, ab->skb);
audit_log_format(ab, "audit(%llu.%03lu:%u): ",
(unsigned long long)ab->stamp.ctime.tv_sec,
ab->stamp.ctime.tv_nsec/1000000,
ab->stamp.serial);
return 0;
err:
kfree_skb(ab->skb);
ab->skb = skb_peek(&ab->skb_list);
return -ENOMEM;
}
/**
* audit_buffer_aux_end - Switch back to the "main" record from an aux record
* @ab: audit_buffer
*
* Restores the "main" audit record to ab->skb.
*/
static void audit_buffer_aux_end(struct audit_buffer *ab)
{
ab->skb = skb_peek(&ab->skb_list);
}
int audit_log_task_context(struct audit_buffer *ab)
{
struct lsmcontext ctx;
@@ -2415,6 +2474,27 @@ int audit_signal_info(int sig, struct task_struct *t)
return audit_signal_info_syscall(t);
}
/**
* __audit_log_end - enqueue one audit record
* @skb: the buffer to send
*/
static void __audit_log_end(struct sk_buff *skb)
{
struct nlmsghdr *nlh;
if (audit_rate_check()) {
/* setup the netlink header, see the comments in
* kauditd_send_multicast_skb() for length quirks */
nlh = nlmsg_hdr(skb);
nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
/* queue the netlink packet and poke the kauditd thread */
skb_queue_tail(&audit_queue, skb);
wake_up_interruptible(&kauditd_wait);
} else
audit_log_lost("rate limit exceeded");
}
/**
* audit_log_end - end one audit record
* @ab: the audit_buffer
@@ -2427,25 +2507,12 @@ int audit_signal_info(int sig, struct task_struct *t)
void audit_log_end(struct audit_buffer *ab)
{
struct sk_buff *skb;
struct nlmsghdr *nlh;
if (!ab)
return;
if (audit_rate_check()) {
skb = ab->skb;
ab->skb = NULL;
/* setup the netlink header, see the comments in
* kauditd_send_multicast_skb() for length quirks */
nlh = nlmsg_hdr(skb);
nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
/* queue the netlink packet and poke the kauditd thread */
skb_queue_tail(&audit_queue, skb);
wake_up_interruptible(&kauditd_wait);
} else
audit_log_lost("rate limit exceeded");
while ((skb = skb_dequeue(&ab->skb_list)))
__audit_log_end(skb);
audit_buffer_free(ab);
}