mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 23:36:23 +09:00
audit: remove the old depricated kernel interface
We used to have an inflexible mechanism to add audit rules to the kernel. It hasn't been used in a long time. Get rid of that stuff. Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris
parent
ab61d38ed8
commit
1890090916
|
|
@ -597,13 +597,14 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
|
|||
return -EPERM;
|
||||
|
||||
switch (msg_type) {
|
||||
case AUDIT_GET:
|
||||
case AUDIT_LIST:
|
||||
case AUDIT_LIST_RULES:
|
||||
case AUDIT_SET:
|
||||
case AUDIT_ADD:
|
||||
case AUDIT_ADD_RULE:
|
||||
case AUDIT_DEL:
|
||||
return -EOPNOTSUPP;
|
||||
case AUDIT_GET:
|
||||
case AUDIT_SET:
|
||||
case AUDIT_LIST_RULES:
|
||||
case AUDIT_ADD_RULE:
|
||||
case AUDIT_DEL_RULE:
|
||||
case AUDIT_SIGNAL_INFO:
|
||||
case AUDIT_TTY_GET:
|
||||
|
|
@ -766,25 +767,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
|
|||
audit_log_end(ab);
|
||||
}
|
||||
break;
|
||||
case AUDIT_ADD:
|
||||
case AUDIT_DEL:
|
||||
if (nlmsg_len(nlh) < sizeof(struct audit_rule))
|
||||
return -EINVAL;
|
||||
if (audit_enabled == AUDIT_LOCKED) {
|
||||
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
|
||||
loginuid, sessionid, sid);
|
||||
|
||||
audit_log_format(ab, " audit_enabled=%d res=0",
|
||||
audit_enabled);
|
||||
audit_log_end(ab);
|
||||
return -EPERM;
|
||||
}
|
||||
/* fallthrough */
|
||||
case AUDIT_LIST:
|
||||
err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
|
||||
seq, data, nlmsg_len(nlh),
|
||||
loginuid, sessionid, sid);
|
||||
break;
|
||||
case AUDIT_ADD_RULE:
|
||||
case AUDIT_DEL_RULE:
|
||||
if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
|
||||
|
|
|
|||
|
|
@ -386,89 +386,6 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
|
|||
return 0;
|
||||
}
|
||||
|
||||
/* Translate struct audit_rule to kernel's rule respresentation.
|
||||
* Exists for backward compatibility with userspace. */
|
||||
static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
|
||||
{
|
||||
struct audit_entry *entry;
|
||||
int err = 0;
|
||||
int i;
|
||||
|
||||
entry = audit_to_entry_common(rule);
|
||||
if (IS_ERR(entry))
|
||||
goto exit_nofree;
|
||||
|
||||
for (i = 0; i < rule->field_count; i++) {
|
||||
struct audit_field *f = &entry->rule.fields[i];
|
||||
u32 n;
|
||||
|
||||
n = rule->fields[i] & (AUDIT_NEGATE|AUDIT_OPERATORS);
|
||||
|
||||
/* Support for legacy operators where
|
||||
* AUDIT_NEGATE bit signifies != and otherwise assumes == */
|
||||
if (n & AUDIT_NEGATE)
|
||||
f->op = Audit_not_equal;
|
||||
else if (!n)
|
||||
f->op = Audit_equal;
|
||||
else
|
||||
f->op = audit_to_op(n);
|
||||
|
||||
entry->rule.vers_ops = (n & AUDIT_OPERATORS) ? 2 : 1;
|
||||
|
||||
f->type = rule->fields[i] & ~(AUDIT_NEGATE|AUDIT_OPERATORS);
|
||||
f->val = rule->values[i];
|
||||
f->uid = INVALID_UID;
|
||||
f->gid = INVALID_GID;
|
||||
|
||||
err = -EINVAL;
|
||||
if (f->op == Audit_bad)
|
||||
goto exit_free;
|
||||
|
||||
err = audit_field_valid(entry, f);
|
||||
if (err)
|
||||
goto exit_free;
|
||||
|
||||
err = -EINVAL;
|
||||
switch (f->type) {
|
||||
case AUDIT_UID:
|
||||
case AUDIT_EUID:
|
||||
case AUDIT_SUID:
|
||||
case AUDIT_FSUID:
|
||||
case AUDIT_LOGINUID:
|
||||
f->uid = make_kuid(current_user_ns(), f->val);
|
||||
if (!uid_valid(f->uid))
|
||||
goto exit_free;
|
||||
break;
|
||||
case AUDIT_GID:
|
||||
case AUDIT_EGID:
|
||||
case AUDIT_SGID:
|
||||
case AUDIT_FSGID:
|
||||
f->gid = make_kgid(current_user_ns(), f->val);
|
||||
if (!gid_valid(f->gid))
|
||||
goto exit_free;
|
||||
break;
|
||||
case AUDIT_ARCH:
|
||||
entry->rule.arch_f = f;
|
||||
break;
|
||||
case AUDIT_INODE:
|
||||
err = audit_to_inode(&entry->rule, f);
|
||||
if (err)
|
||||
goto exit_free;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
|
||||
entry->rule.inode_f = NULL;
|
||||
|
||||
exit_nofree:
|
||||
return entry;
|
||||
|
||||
exit_free:
|
||||
audit_free_rule(entry);
|
||||
return ERR_PTR(err);
|
||||
}
|
||||
|
||||
/* Translate struct audit_rule_data to kernel's rule respresentation. */
|
||||
static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
|
||||
size_t datasz)
|
||||
|
|
@ -622,36 +539,6 @@ static inline size_t audit_pack_string(void **bufp, const char *str)
|
|||
return len;
|
||||
}
|
||||
|
||||
/* Translate kernel rule respresentation to struct audit_rule.
|
||||
* Exists for backward compatibility with userspace. */
|
||||
static struct audit_rule *audit_krule_to_rule(struct audit_krule *krule)
|
||||
{
|
||||
struct audit_rule *rule;
|
||||
int i;
|
||||
|
||||
rule = kzalloc(sizeof(*rule), GFP_KERNEL);
|
||||
if (unlikely(!rule))
|
||||
return NULL;
|
||||
|
||||
rule->flags = krule->flags | krule->listnr;
|
||||
rule->action = krule->action;
|
||||
rule->field_count = krule->field_count;
|
||||
for (i = 0; i < rule->field_count; i++) {
|
||||
rule->values[i] = krule->fields[i].val;
|
||||
rule->fields[i] = krule->fields[i].type;
|
||||
|
||||
if (krule->vers_ops == 1) {
|
||||
if (krule->fields[i].op == Audit_not_equal)
|
||||
rule->fields[i] |= AUDIT_NEGATE;
|
||||
} else {
|
||||
rule->fields[i] |= audit_ops[krule->fields[i].op];
|
||||
}
|
||||
}
|
||||
for (i = 0; i < AUDIT_BITMASK_SIZE; i++) rule->mask[i] = krule->mask[i];
|
||||
|
||||
return rule;
|
||||
}
|
||||
|
||||
/* Translate kernel rule respresentation to struct audit_rule_data. */
|
||||
static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
|
||||
{
|
||||
|
|
@ -1064,35 +951,6 @@ static inline int audit_del_rule(struct audit_entry *entry)
|
|||
return ret;
|
||||
}
|
||||
|
||||
/* List rules using struct audit_rule. Exists for backward
|
||||
* compatibility with userspace. */
|
||||
static void audit_list(int pid, int seq, struct sk_buff_head *q)
|
||||
{
|
||||
struct sk_buff *skb;
|
||||
struct audit_krule *r;
|
||||
int i;
|
||||
|
||||
/* This is a blocking read, so use audit_filter_mutex instead of rcu
|
||||
* iterator to sync with list writers. */
|
||||
for (i=0; i<AUDIT_NR_FILTERS; i++) {
|
||||
list_for_each_entry(r, &audit_rules_list[i], list) {
|
||||
struct audit_rule *rule;
|
||||
|
||||
rule = audit_krule_to_rule(r);
|
||||
if (unlikely(!rule))
|
||||
break;
|
||||
skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
|
||||
rule, sizeof(*rule));
|
||||
if (skb)
|
||||
skb_queue_tail(q, skb);
|
||||
kfree(rule);
|
||||
}
|
||||
}
|
||||
skb = audit_make_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
|
||||
if (skb)
|
||||
skb_queue_tail(q, skb);
|
||||
}
|
||||
|
||||
/* List rules using struct audit_rule_data. */
|
||||
static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
|
||||
{
|
||||
|
|
@ -1173,7 +1031,6 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
|
|||
struct audit_entry *entry;
|
||||
|
||||
switch (type) {
|
||||
case AUDIT_LIST:
|
||||
case AUDIT_LIST_RULES:
|
||||
/* We can't just spew out the rules here because we might fill
|
||||
* the available socket buffer space and deadlock waiting for
|
||||
|
|
@ -1188,10 +1045,7 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
|
|||
skb_queue_head_init(&dest->q);
|
||||
|
||||
mutex_lock(&audit_filter_mutex);
|
||||
if (type == AUDIT_LIST)
|
||||
audit_list(pid, seq, &dest->q);
|
||||
else
|
||||
audit_list_rules(pid, seq, &dest->q);
|
||||
audit_list_rules(pid, seq, &dest->q);
|
||||
mutex_unlock(&audit_filter_mutex);
|
||||
|
||||
tsk = kthread_run(audit_send_list, dest, "audit_send_list");
|
||||
|
|
@ -1201,12 +1055,8 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
|
|||
err = PTR_ERR(tsk);
|
||||
}
|
||||
break;
|
||||
case AUDIT_ADD:
|
||||
case AUDIT_ADD_RULE:
|
||||
if (type == AUDIT_ADD)
|
||||
entry = audit_rule_to_entry(data);
|
||||
else
|
||||
entry = audit_data_to_entry(data, datasz);
|
||||
entry = audit_data_to_entry(data, datasz);
|
||||
if (IS_ERR(entry))
|
||||
return PTR_ERR(entry);
|
||||
|
||||
|
|
@ -1217,12 +1067,8 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
|
|||
if (err)
|
||||
audit_free_rule(entry);
|
||||
break;
|
||||
case AUDIT_DEL:
|
||||
case AUDIT_DEL_RULE:
|
||||
if (type == AUDIT_DEL)
|
||||
entry = audit_rule_to_entry(data);
|
||||
else
|
||||
entry = audit_data_to_entry(data, datasz);
|
||||
entry = audit_data_to_entry(data, datasz);
|
||||
if (IS_ERR(entry))
|
||||
return PTR_ERR(entry);
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user