Commit 4a6633ed authored by Peter Moody's avatar Peter Moody Committed by Al Viro

audit: implement all object interfield comparisons

This completes the matrix of interfield comparisons between uid/gid
information for the current task and the uid/gid information for inodes.
aka I can audit based on differences between the euid of the process and
the uid of fs objects.
Signed-off-by: default avatarPeter Moody <pmoody@google.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent c9fe685f
...@@ -185,8 +185,16 @@ ...@@ -185,8 +185,16 @@
/* AUDIT_FIELD_COMPARE rule list */ /* AUDIT_FIELD_COMPARE rule list */
#define AUDIT_COMPARE_UID_TO_OBJ_UID 1 #define AUDIT_COMPARE_UID_TO_OBJ_UID 1
#define AUDIT_COMPARE_GID_TO_OBJ_GID 2 #define AUDIT_COMPARE_GID_TO_OBJ_GID 2
#define AUDIT_COMPARE_EUID_TO_OBJ_UID 3
#define AUDIT_COMPARE_EGID_TO_OBJ_GID 4
#define AUDIT_COMPARE_AUID_TO_OBJ_UID 5
#define AUDIT_COMPARE_SUID_TO_OBJ_UID 6
#define AUDIT_COMPARE_SGID_TO_OBJ_GID 7
#define AUDIT_COMPARE_FSUID_TO_OBJ_UID 8
#define AUDIT_COMPARE_FSGID_TO_OBJ_GID 9
#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_FSGID_TO_OBJ_GID
#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_GID_TO_OBJ_GID
/* Rule fields */ /* Rule fields */
/* These are useful when checking the /* These are useful when checking the
* task structure at task creation time * task structure at task creation time
......
...@@ -508,6 +508,7 @@ static int audit_field_compare(struct task_struct *tsk, ...@@ -508,6 +508,7 @@ static int audit_field_compare(struct task_struct *tsk,
struct audit_names *name) struct audit_names *name)
{ {
switch (f->val) { switch (f->val) {
/* process to file object comparisons */
case AUDIT_COMPARE_UID_TO_OBJ_UID: case AUDIT_COMPARE_UID_TO_OBJ_UID:
return audit_compare_id(cred->uid, return audit_compare_id(cred->uid,
name, offsetof(struct audit_names, uid), name, offsetof(struct audit_names, uid),
...@@ -516,6 +517,34 @@ static int audit_field_compare(struct task_struct *tsk, ...@@ -516,6 +517,34 @@ static int audit_field_compare(struct task_struct *tsk,
return audit_compare_id(cred->gid, return audit_compare_id(cred->gid,
name, offsetof(struct audit_names, gid), name, offsetof(struct audit_names, gid),
f, ctx); f, ctx);
case AUDIT_COMPARE_EUID_TO_OBJ_UID:
return audit_compare_id(cred->euid,
name, offsetof(struct audit_names, uid),
f, ctx);
case AUDIT_COMPARE_EGID_TO_OBJ_GID:
return audit_compare_id(cred->egid,
name, offsetof(struct audit_names, gid),
f, ctx);
case AUDIT_COMPARE_AUID_TO_OBJ_UID:
return audit_compare_id(tsk->loginuid,
name, offsetof(struct audit_names, uid),
f, ctx);
case AUDIT_COMPARE_SUID_TO_OBJ_UID:
return audit_compare_id(cred->suid,
name, offsetof(struct audit_names, uid),
f, ctx);
case AUDIT_COMPARE_SGID_TO_OBJ_GID:
return audit_compare_id(cred->sgid,
name, offsetof(struct audit_names, gid),
f, ctx);
case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
return audit_compare_id(cred->fsuid,
name, offsetof(struct audit_names, uid),
f, ctx);
case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
return audit_compare_id(cred->fsgid,
name, offsetof(struct audit_names, gid),
f, ctx);
default: default:
WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n"); WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n");
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment