audit: hand taken context to audit_kill_trees for syscall logging

Since the context is derived from the task parameter handed to
__audit_free(), hand the context to audit_kill_trees() so it can be used
to associate with a syscall record.  This requires adding the context
parameter to kill_rules() rather than using the current audit_context.

The callers of trim_marked() and evict_chunk() still have their context.

The EOE record was being issued prior to the pruning of the killed_tree
list.

Move the kill_trees call before the audit_log_exit call in
__audit_free() and __audit_syscall_exit() so that any pruned trees
CONFIG_CHANGE records are included with the associated syscall event by
the user library due to the EOE record flagging the end of the event.

See: https://github.com/linux-audit/audit-kernel/issues/50
See: https://github.com/linux-audit/audit-kernel/issues/59

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed merge fuzz in kernel/audit_tree.c]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/kernel/audit.h b/kernel/audit.h
index 91421679a16889d75706d08dc7367ed5eee8812f..6ffb70575082044596afb52026e91eaef7ae4bce 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -314,7 +314,7 @@ extern void audit_trim_trees(void);
 extern int audit_tag_tree(char *old, char *new);
 extern const char *audit_tree_path(struct audit_tree *tree);
 extern void audit_put_tree(struct audit_tree *tree);
-extern void audit_kill_trees(struct list_head *list);
+extern void audit_kill_trees(struct audit_context *context);
 #else
 #define audit_remove_tree_rule(rule) BUG()
 #define audit_add_tree_rule(rule) -EINVAL
@@ -323,7 +323,7 @@ extern void audit_kill_trees(struct list_head *list);
 #define audit_put_tree(tree) (void)0
 #define audit_tag_tree(old, new) -EINVAL
 #define audit_tree_path(rule) ""       /* never called */
-#define audit_kill_trees(list) BUG()
+#define audit_kill_trees(context) BUG()
 #endif
 
 extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);

diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index d4af4d97f847a84b8303188ec66c7299a56af2e4..abfb112f26aa41e8efe8fe1824bd1f7785057999 100644 (file)
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -524,13 +524,14 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
        return 0;
 }
 
-static void audit_tree_log_remove_rule(struct audit_krule *rule)
+static void audit_tree_log_remove_rule(struct audit_context *context,
+                                      struct audit_krule *rule)
 {
        struct audit_buffer *ab;
 
        if (!audit_enabled)
                return;
-       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
        if (unlikely(!ab))
                return;
        audit_log_format(ab, "op=remove_rule dir=");
@@ -540,7 +541,7 @@ static void audit_tree_log_remove_rule(struct audit_krule *rule)
        audit_log_end(ab);
 }
 
-static void kill_rules(struct audit_tree *tree)
+static void kill_rules(struct audit_context *context, struct audit_tree *tree)
 {
        struct audit_krule *rule, *next;
        struct audit_entry *entry;
@@ -551,7 +552,7 @@ static void kill_rules(struct audit_tree *tree)
                list_del_init(&rule->rlist);
                if (rule->tree) {
                        /* not a half-baked one */
-                       audit_tree_log_remove_rule(rule);
+                       audit_tree_log_remove_rule(context, rule);
                        if (entry->rule.exe)
                                audit_remove_mark(entry->rule.exe);
                        rule->tree = NULL;
@@ -633,7 +634,7 @@ static void trim_marked(struct audit_tree *tree)
                tree->goner = 1;
                spin_unlock(&hash_lock);
                mutex_lock(&audit_filter_mutex);
-               kill_rules(tree);
+               kill_rules(audit_context(), tree);
                list_del_init(&tree->list);
                mutex_unlock(&audit_filter_mutex);
                prune_one(tree);
@@ -973,8 +974,10 @@ static void audit_schedule_prune(void)
  * ... and that one is done if evict_chunk() decides to delay until the end
  * of syscall.  Runs synchronously.
  */
-void audit_kill_trees(struct list_head *list)
+void audit_kill_trees(struct audit_context *context)
 {
+       struct list_head *list = &context->killed_trees;
+
        audit_ctl_lock();
        mutex_lock(&audit_filter_mutex);
 
@@ -982,7 +985,7 @@ void audit_kill_trees(struct list_head *list)
                struct audit_tree *victim;
 
                victim = list_entry(list->next, struct audit_tree, list);
-               kill_rules(victim);
+               kill_rules(context, victim);
                list_del_init(&victim->list);
 
                mutex_unlock(&audit_filter_mutex);
@@ -1017,7 +1020,7 @@ static void evict_chunk(struct audit_chunk *chunk)
                list_del_init(&owner->same_root);
                spin_unlock(&hash_lock);
                if (!postponed) {
-                       kill_rules(owner);
+                       kill_rules(audit_context(), owner);
                        list_move(&owner->list, &prune_list);
                        need_prune = 1;
                } else {

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6593a5207fb03f28a24bf1dfd6a52bcc77412024..b585ceb2f7a2c68d0bc4187f8c16cd0492f15f0b 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1444,6 +1444,9 @@ void __audit_free(struct task_struct *tsk)
        if (!context)
                return;
 
+       if (!list_empty(&context->killed_trees))
+               audit_kill_trees(context);
+
        /* We are called either by do_exit() or the fork() error handling code;
         * in the former case tsk == current and in the latter tsk is a
         * random task_struct that doesn't doesn't have any meaningful data we
@@ -1460,9 +1463,6 @@ void __audit_free(struct task_struct *tsk)
                        audit_log_exit();
        }
 
-       if (!list_empty(&context->killed_trees))
-               audit_kill_trees(&context->killed_trees);
-
        audit_set_context(tsk, NULL);
        audit_free_context(context);
 }
@@ -1537,6 +1537,9 @@ void __audit_syscall_exit(int success, long return_code)
        if (!context)
                return;
 
+       if (!list_empty(&context->killed_trees))
+               audit_kill_trees(context);
+
        if (!context->dummy && context->in_syscall) {
                if (success)
                        context->return_valid = AUDITSC_SUCCESS;
@@ -1571,9 +1574,6 @@ void __audit_syscall_exit(int success, long return_code)
        context->in_syscall = 0;
        context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
 
-       if (!list_empty(&context->killed_trees))
-               audit_kill_trees(&context->killed_trees);
-
        audit_free_names(context);
        unroll_tree_refs(context, NULL, 0);
        audit_free_aux(context);