tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: apparmor4.0.0 [25/90]: LSM stacking v39: audit: multiple subject lsm values for netlabel

Browse Source 
BugLink: http://bugs.launchpad.net/bugs/2028253

Refactor audit_log_task_context(), creating a new
audit_log_subject_context(). This is used in netlabel auditing
to provide multiple subject security contexts as necessary.

Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
(cherry picked from commit 58a600950ecf3e279a11df4df273e3bbd5a83a44
https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
This commit is contained in:
Casey Schaufler
2023-08-18 09:24:05 -07:00
committed by Paolo Pisati
parent 5b201d17b4
commit fab8abd89c
3 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/linux/audit.h
+8
View File
@@ -37,6 +37,7 @@ struct audit_watch;
struct audit_tree;
struct sk_buff;
struct kern_ipc_perm;
struct lsmblob;
struct audit_krule {
u32 pflags;
@@ -185,6 +186,8 @@ extern void audit_log_path_denied(int type,
const char *operation);
extern void audit_log_lost(const char *message);
extern int audit_log_subject_context(struct audit_buffer *ab,
struct lsmblob *blob);
extern int audit_log_task_context(struct audit_buffer *ab);
extern void audit_log_task_info(struct audit_buffer *ab);
@@ -245,6 +248,11 @@ static inline void audit_log_key(struct audit_buffer *ab, char *key)
{ }
static inline void audit_log_path_denied(int type, const char *operation)
{ }
static inline int audit_log_subject_context(struct audit_buffer *ab,
struct lsmblob *blob)
{
return 0;
}
static inline int audit_log_task_context(struct audit_buffer *ab)
{
return 0;
kernel/audit.c
+14 -7
View File
@@ -2242,20 +2242,18 @@ static void audit_buffer_aux_end(struct audit_buffer *ab)
ab->skb = skb_peek(&ab->skb_list);
}
int audit_log_task_context(struct audit_buffer *ab)
int audit_log_subject_context(struct audit_buffer *ab, struct lsmblob *blob)
{
struct lsmcontext ctx;
struct lsmblob blob;
bool space = false;
int error;
int i;
security_current_getlsmblob_subj(&blob);
if (!lsmblob_is_set(&blob))
if (!lsmblob_is_set(blob))
return 0;
if (lsm_blob_cnt < 2) {
error = security_lsmblob_to_secctx(&blob, &ctx, LSM_ID_UNDEF);
error = security_lsmblob_to_secctx(blob, &ctx, LSM_ID_UNDEF);
if (error < 0) {
if (error != -EINVAL)
goto error_path;
@@ -2274,7 +2272,7 @@ int audit_log_task_context(struct audit_buffer *ab)
for (i = 0; i < lsm_active_cnt; i++) {
if (!lsm_idlist[i]->lsmblob)
continue;
error = security_lsmblob_to_secctx(&blob, &ctx,
error = security_lsmblob_to_secctx(blob, &ctx,
lsm_idlist[i]->id);
if (error < 0) {
if (error == -EOPNOTSUPP)
@@ -2294,9 +2292,18 @@ int audit_log_task_context(struct audit_buffer *ab)
return 0;
error_path:
audit_panic("error in audit_log_task_context");
audit_panic("error in audit_log_subject_context");
return error;
}
EXPORT_SYMBOL(audit_log_subject_context);
int audit_log_task_context(struct audit_buffer *ab)
{
struct lsmblob blob;
security_current_getlsmblob_subj(&blob);
return audit_log_subject_context(ab, &blob);
}
EXPORT_SYMBOL(audit_log_task_context);
void audit_log_d_path_exe(struct audit_buffer *ab,
net/netlabel/netlabel_user.c
+1 -7
View File
@@ -84,7 +84,6 @@ struct audit_buffer *netlbl_audit_start_common(int type,
struct netlbl_audit *audit_info)
{
struct audit_buffer *audit_buf;
struct lsmcontext ctx;
if (audit_enabled == AUDIT_OFF)
return NULL;
@@ -97,12 +96,7 @@ struct audit_buffer *netlbl_audit_start_common(int type,
from_kuid(&init_user_ns, audit_info->loginuid),
audit_info->sessionid);
if (lsmblob_is_set(&audit_info->blob) &&
security_lsmblob_to_secctx(&audit_info->blob, &ctx,
LSM_ID_UNDEF) >= 0) {
audit_log_format(audit_buf, " subj=%s", ctx.context);
security_release_secctx(&ctx);
}
audit_log_subject_context(audit_buf, &audit_info->blob);
return audit_buf;
}