Merge git://git.infradead.org/users/eparis/audit

[cascardo/linux.git] / kernel / audit.c

diff --git a/kernel/audit.c b/kernel/audit.c
index 95a20f3..7c28936 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 
 struct audit_reply {
        __u32 portid;
-       struct net *net;        
+       struct net *net;
        struct sk_buff *skb;
 };
 
@@ -396,7 +396,7 @@ static void audit_printk_skb(struct sk_buff *skb)
                if (printk_ratelimit())
                        pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
                else
-                       audit_log_lost("printk limit exceeded\n");
+                       audit_log_lost("printk limit exceeded");
        }
 
        audit_hold_skb(skb);
@@ -412,7 +412,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
                BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
                if (audit_pid) {
                        pr_err("*NO* daemon at audit_pid=%d\n", audit_pid);
-                       audit_log_lost("auditd disappeared\n");
+                       audit_log_lost("auditd disappeared");
                        audit_pid = 0;
                        audit_sock = NULL;
                }
@@ -607,7 +607,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 {
        int err = 0;
 
-       /* Only support the initial namespaces for now. */
+       /* Only support initial user namespace for now. */
        /*
         * We return ECONNREFUSED because it tricks userspace into thinking
         * that audit was not configured into the kernel.  Lots of users
@@ -618,8 +618,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         * userspace will reject all logins.  This should be removed when we
         * support non init namespaces!!
         */
-       if ((current_user_ns() != &init_user_ns) ||
-           (task_active_pid_ns(current) != &init_pid_ns))
+       if (current_user_ns() != &init_user_ns)
                return -ECONNREFUSED;
 
        switch (msg_type) {
@@ -639,6 +638,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
        case AUDIT_TTY_SET:
        case AUDIT_TRIM:
        case AUDIT_MAKE_EQUIV:
+               /* Only support auditd and auditctl in initial pid namespace
+                * for now. */
+               if ((task_active_pid_ns(current) != &init_pid_ns))
+                       return -EPERM;
+
                if (!capable(CAP_AUDIT_CONTROL))
                        err = -EPERM;
                break;
@@ -659,6 +663,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
 {
        int rc = 0;
        uid_t uid = from_kuid(&init_user_ns, current_uid());
+       pid_t pid = task_tgid_nr(current);
 
        if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
                *ab = NULL;
@@ -668,7 +673,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
        *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
        if (unlikely(!*ab))
                return rc;
-       audit_log_format(*ab, "pid=%d uid=%u", task_tgid_vnr(current), uid);
+       audit_log_format(*ab, "pid=%d uid=%u", pid, uid);
        audit_log_session_info(*ab);
        audit_log_task_context(*ab);
 
@@ -1097,7 +1102,7 @@ static void __net_exit audit_net_exit(struct net *net)
                audit_sock = NULL;
        }
 
-       rcu_assign_pointer(aunet->nlsk, NULL);
+       RCU_INIT_POINTER(aunet->nlsk, NULL);
        synchronize_net();
        netlink_kernel_release(sock);
 }
@@ -1829,11 +1834,11 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
        spin_unlock_irq(&tsk->sighand->siglock);
 
        audit_log_format(ab,
-                        " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
+                        " ppid=%d pid=%d auid=%u uid=%u gid=%u"
                         " euid=%u suid=%u fsuid=%u"
                         " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
-                        sys_getppid(),
-                        tsk->pid,
+                        task_ppid_nr(tsk),
+                        task_pid_nr(tsk),
                         from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
                         from_kuid(&init_user_ns, cred->uid),
                         from_kgid(&init_user_ns, cred->gid),