Commit 1320a405 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore

audit: trigger accompanying records when no rules present

When there are no audit rules registered, mandatory records (config,
etc.) are missing their accompanying records (syscall, proctitle, etc.).

This is due to audit context dummy set on syscall entry based on absence
of rules that signals that no other records are to be printed.

Clear the dummy bit if any record is generated.

The proctitle context and dummy checks are pointless since the
proctitle record will not be printed if no syscall records are printed.

Please see upstream github issue
https://github.com/linux-audit/audit-kernel/issues/120Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 70b3eeed
...@@ -1798,6 +1798,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, ...@@ -1798,6 +1798,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
} }
audit_get_stamp(ab->ctx, &t, &serial); audit_get_stamp(ab->ctx, &t, &serial);
audit_clear_dummy(ab->ctx);
audit_log_format(ab, "audit(%llu.%03lu:%u): ", audit_log_format(ab, "audit(%llu.%03lu:%u): ",
(unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
......
...@@ -290,6 +290,13 @@ extern int audit_signal_info_syscall(struct task_struct *t); ...@@ -290,6 +290,13 @@ extern int audit_signal_info_syscall(struct task_struct *t);
extern void audit_filter_inodes(struct task_struct *tsk, extern void audit_filter_inodes(struct task_struct *tsk,
struct audit_context *ctx); struct audit_context *ctx);
extern struct list_head *audit_killed_trees(void); extern struct list_head *audit_killed_trees(void);
static inline void audit_clear_dummy(struct audit_context *ctx)
{
if (ctx)
ctx->dummy = 0;
}
#else /* CONFIG_AUDITSYSCALL */ #else /* CONFIG_AUDITSYSCALL */
#define auditsc_get_stamp(c, t, s) 0 #define auditsc_get_stamp(c, t, s) 0
#define audit_put_watch(w) {} #define audit_put_watch(w) {}
...@@ -323,6 +330,7 @@ static inline int audit_signal_info_syscall(struct task_struct *t) ...@@ -323,6 +330,7 @@ static inline int audit_signal_info_syscall(struct task_struct *t)
} }
#define audit_filter_inodes(t, c) AUDIT_DISABLED #define audit_filter_inodes(t, c) AUDIT_DISABLED
#define audit_clear_dummy(c) {}
#endif /* CONFIG_AUDITSYSCALL */ #endif /* CONFIG_AUDITSYSCALL */
extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
......
...@@ -1406,9 +1406,6 @@ static void audit_log_proctitle(void) ...@@ -1406,9 +1406,6 @@ static void audit_log_proctitle(void)
struct audit_context *context = audit_context(); struct audit_context *context = audit_context();
struct audit_buffer *ab; struct audit_buffer *ab;
if (!context || context->dummy)
return;
ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
if (!ab) if (!ab)
return; /* audit_panic or being filtered */ return; /* audit_panic or being filtered */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment