diff options
| author | Paul Moore <pmoore@redhat.com> | 2014-12-19 18:35:53 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-01-08 10:30:27 -0800 |
| commit | dbe0ca090fcc181319d56c27b90a9946647650a9 (patch) | |
| tree | 254716a80afbfdb0dd3beeff2b28ab4eb8a9f16e /kernel | |
| parent | 1110f3504d4697ef459fe9a4a1b1704649e2a444 (diff) | |
audit: don't attempt to lookup PIDs when changing PID filtering audit rules
commit 3640dcfa4fd00cd91d88bb86250bdb496f7070c0 upstream.
Commit f1dc4867 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system. The following commands demonstrate a simple
reproducer.
# auditctl -D
# auditctl -l
# autrace /bin/true
# auditctl -l
This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.
Cc: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/auditfilter.c | 13 |
1 files changed, 0 insertions, 13 deletions
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 3598e13f2a65..dfafa4ea6e5f 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -444,19 +444,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, f->val = 0; } - if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) { - struct pid *pid; - rcu_read_lock(); - pid = find_vpid(f->val); - if (!pid) { - rcu_read_unlock(); - err = -ESRCH; - goto exit_free; - } - f->val = pid_nr(pid); - rcu_read_unlock(); - } - err = audit_field_valid(entry, f); if (err) goto exit_free; |