linux/kernel/audit.c, branch v2.6.30

Audit: remove spaces from audit_log_d_path

2009-04-05T17:49:04Z

audit_log_d_path had spaces in the strings which would be emitted on the error paths. This patch simply replaces those spaces with an _ or removes the needless spaces entirely. Signed-off-by: Eric Paris Signed-off-by: Al Viro

audit: ignore terminating NUL in AUDIT_USER_TTY messages

2009-04-05T17:43:36Z

AUDIT_USER_TTY, like all other messages sent from user-space, is sent NUL-terminated. Unlike other user-space audit messages, which come only from trusted sources, AUDIT_USER_TTY messages are processed using audit_log_n_untrustedstring(). This patch modifies AUDIT_USER_TTY handling to ignore the trailing NUL and use the "quoted_string" representation of the message if possible. Signed-off-by: Miloslav Trmac Cc: Eric Paris Cc: Al Viro Cc: Steve Grubb Signed-off-by: Andrew Morton Signed-off-by: Al Viro

Audit: fix handling of 'strings' with NULL characters

2009-04-05T17:43:24Z

currently audit_log_n_untrustedstring() uses audit_string_contains_control() to check if the 'string' has any control characters. If the 'string' has an embedded NULL audit_string_contains_control() will return that the data has no control characters and will then pass the string to audit_log_n_string with the total length, not the length up to the first NULL. audit_log_n_string() does a memcpy of the entire length and so the actual audit record emitted may then contain a NULL and then whatever random memory is after the NULL. Since we want to log the entire octet stream (if we can't trust the data to be a string we can't trust that a NULL isn't actually a part of it) we should just consider NULL as a control character. If the caller is certain they want to stop at the first NULL they should be using audit_log_untrustedstring. Signed-off-by: Eric Paris Signed-off-by: Al Viro

[PATCH] fix broken timestamps in AVC generated by kernel threads

2008-12-09T07:27:41Z

Timestamp in audit_context is valid only if ->in_syscall is set. Signed-off-by: Al Viro

[PATCH] Audit: make audit=0 actually turn off audit

2008-12-09T07:27:37Z

Currently audit=0 on the kernel command line does absolutely nothing. Audit always loads and always uses its resources such as creating the kernel netlink socket. This patch causes audit=0 to actually disable audit. Audit will use no resources and starting the userspace auditd daemon will not cause the kernel audit system to activate. Signed-off-by: Eric Paris Signed-off-by: Al Viro

[PATCH] Fix the bug of using AUDIT_STATUS_RATE_LIMIT when set fail, no error output.

2008-08-01T16:15:16Z

When the "status_get->mask" is "AUDIT_STATUS_RATE_LIMIT || AUDIT_STATUS_BACKLOG_LIMIT". If "audit_set_rate_limit" fails and "audit_set_backlog_limit" succeeds, the "err" value will be greater than or equal to 0. It will miss the failure of rate set. Signed-off-by: Zhang Xiliang Acked-by: Eric Paris Signed-off-by: Al Viro

kernel/audit.c control character detection is off-by-one

2008-08-01T16:05:35Z

Hello, According to my understanding there is an off-by-one bug in the function: audit_string_contains_control() in: kernel/audit.c Patch is included. I do not know from how many places the function is called from, but for example, SELinux Access Vector Cache tries to log untrusted filenames via call path: avc_audit() audit_log_untrustedstring() audit_log_n_untrustedstring() audit_string_contains_control() If audit_string_contains_control() detects control characters, then the string is hex-encoded. But the hex=0x7f dec=127, DEL-character, is not detected. I guess this could have at least some minor security implications, since a user can create a filename with 0x7f in it, causing logged filename to possibly look different when someone reads it on the terminal. Signed-off-by: Vesa-Matti Kari Signed-off-by: Al Viro

[PATCH] remove useless argument type in audit_filter_user()

2008-06-25T03:36:35Z

The second argument "type" is not used in audit_filter_user(), so I think that type can be removed. If I'm wrong, please tell me. Signed-off-by: Peng Haitao Signed-off-by: Al Viro

[PATCH] kernel/audit.c: nlh->nlmsg_type is gotten more than once

2008-06-25T03:36:21Z

The first argument "nlh->nlmsg_type" of audit_receive_filter() should be modified to "msg_type" in audit_receive_msg(). Signed-off-by: Peng Haitao Signed-off-by: Al Viro

[patch 1/1] audit_send_reply(): fix error-path memory leak

2008-05-17T07:30:22Z

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=10663 Reporter: Daniel Marjamki Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Al Viro