• Richard Guy Briggs's avatar
    audit: trigger accompanying records when no rules present · 6d915476
    Richard Guy Briggs authored
    When there are no audit rules registered, mandatory records (config,
    etc.) are missing their accompanying records (syscall, proctitle, etc.).
    
    This is due to audit context dummy set on syscall entry based on absence
    of rules that signals that no other records are to be printed.  Clear the dummy
    bit if any record is generated, open coding this in audit_log_start().
    
    The proctitle context and dummy checks are pointless since the
    proctitle record will not be printed if no syscall records are printed.
    
    The fds array is reset to -1 after the first syscall to indicate it
    isn't valid any more, but was never set to -1 when the context was
    allocated to indicate it wasn't yet valid.
    
    Check ctx->pwd in audit_log_name().
    
    The audit_inode* functions can be called without going through
    getname_flags() or getname_kernel() that sets audit_names and cwd, so
    set the cwd in audit_alloc_name() if it has not already been done so due to
    audit_names being valid and purge all other audit_getcwd() calls.
    
    Revert the LSM dump_common_audit_data() LSM_AUDIT_DATA_* cases from the
    ghak96 patch since they are no longer necessary due to cwd coverage in
    audit_alloc_name().
    
    Thanks to bauen1 <j2468h@googlemail.com> for reporting LSM situations in
    which context->cwd is not valid, inadvertantly fixed by the ghak96 patch.
    
    Please see upstream github issue
    https://github.com/linux-audit/audit-kernel/issues/120
    This is also related to upstream github issue
    https://github.com/linux-audit/audit-kernel/issues/96Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    6d915476
auditsc.c 71.7 KB