sanitize audit_socketcall
* don't bother with allocations * now that it can't fail, make it return void Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro
parent
4f6b434fee
commit
f3298dc4f2
3 changed files with 41 additions and 33 deletions
|
|
@ -446,7 +446,7 @@ extern void audit_log_task_context(struct audit_buffer *ab);
|
|||
extern int __audit_ipc_obj(struct kern_ipc_perm *ipcp);
|
||||
extern int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);
|
||||
extern int audit_bprm(struct linux_binprm *bprm);
|
||||
extern int audit_socketcall(int nargs, unsigned long *args);
|
||||
extern void audit_socketcall(int nargs, unsigned long *args);
|
||||
extern int audit_sockaddr(int len, void *addr);
|
||||
extern int __audit_fd_pair(int fd1, int fd2);
|
||||
extern int audit_set_macxattr(const char *name);
|
||||
|
|
@ -549,7 +549,7 @@ extern int audit_signals;
|
|||
#define audit_ipc_obj(i) ({ 0; })
|
||||
#define audit_ipc_set_perm(q,u,g,m) ({ 0; })
|
||||
#define audit_bprm(p) ({ 0; })
|
||||
#define audit_socketcall(n,a) ({ 0; })
|
||||
#define audit_socketcall(n,a) ((void)0)
|
||||
#define audit_fd_pair(n,a) ({ 0; })
|
||||
#define audit_sockaddr(len, addr) ({ 0; })
|
||||
#define audit_set_macxattr(n) do { ; } while (0)
|
||||
|
|
|
|||
|
|
@ -168,12 +168,6 @@ struct audit_aux_data_execve {
|
|||
struct mm_struct *mm;
|
||||
};
|
||||
|
||||
struct audit_aux_data_socketcall {
|
||||
struct audit_aux_data d;
|
||||
int nargs;
|
||||
unsigned long args[0];
|
||||
};
|
||||
|
||||
struct audit_aux_data_fd_pair {
|
||||
struct audit_aux_data d;
|
||||
int fd[2];
|
||||
|
|
@ -247,6 +241,14 @@ struct audit_context {
|
|||
struct audit_tree_refs *trees, *first_trees;
|
||||
int tree_count;
|
||||
|
||||
int type;
|
||||
union {
|
||||
struct {
|
||||
int nargs;
|
||||
long args[6];
|
||||
} socketcall;
|
||||
};
|
||||
|
||||
#if AUDIT_DEBUG
|
||||
int put_count;
|
||||
int ino_count;
|
||||
|
|
@ -1226,6 +1228,27 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
|
|||
audit_log_format(ab, " cap_fe=%d cap_fver=%x", name->fcap.fE, name->fcap_ver);
|
||||
}
|
||||
|
||||
static void show_special(struct audit_context *context)
|
||||
{
|
||||
struct audit_buffer *ab;
|
||||
int i;
|
||||
|
||||
ab = audit_log_start(context, GFP_KERNEL, context->type);
|
||||
if (!ab)
|
||||
return;
|
||||
|
||||
switch (context->type) {
|
||||
case AUDIT_SOCKETCALL: {
|
||||
int nargs = context->socketcall.nargs;
|
||||
audit_log_format(ab, "nargs=%d", nargs);
|
||||
for (i = 0; i < nargs; i++)
|
||||
audit_log_format(ab, " a%d=%lx", i,
|
||||
context->socketcall.args[i]);
|
||||
break; }
|
||||
}
|
||||
audit_log_end(ab);
|
||||
}
|
||||
|
||||
static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
|
||||
{
|
||||
const struct cred *cred;
|
||||
|
|
@ -1372,13 +1395,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
|
|||
audit_log_execve_info(context, &ab, axi);
|
||||
break; }
|
||||
|
||||
case AUDIT_SOCKETCALL: {
|
||||
struct audit_aux_data_socketcall *axs = (void *)aux;
|
||||
audit_log_format(ab, "nargs=%d", axs->nargs);
|
||||
for (i=0; i<axs->nargs; i++)
|
||||
audit_log_format(ab, " a%d=%lx", i, axs->args[i]);
|
||||
break; }
|
||||
|
||||
case AUDIT_FD_PAIR: {
|
||||
struct audit_aux_data_fd_pair *axs = (void *)aux;
|
||||
audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
|
||||
|
|
@ -1410,6 +1426,9 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
|
|||
audit_log_end(ab);
|
||||
}
|
||||
|
||||
if (context->type)
|
||||
show_special(context);
|
||||
|
||||
if (context->sockaddr_len) {
|
||||
ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
|
||||
if (ab) {
|
||||
|
|
@ -1689,6 +1708,7 @@ void audit_syscall_exit(int valid, long return_code)
|
|||
context->target_pid = 0;
|
||||
context->target_sid = 0;
|
||||
context->sockaddr_len = 0;
|
||||
context->type = 0;
|
||||
kfree(context->filterkey);
|
||||
context->filterkey = NULL;
|
||||
tsk->audit_context = context;
|
||||
|
|
@ -2406,27 +2426,17 @@ int audit_bprm(struct linux_binprm *bprm)
|
|||
* @nargs: number of args
|
||||
* @args: args array
|
||||
*
|
||||
* Returns 0 for success or NULL context or < 0 on error.
|
||||
*/
|
||||
int audit_socketcall(int nargs, unsigned long *args)
|
||||
void audit_socketcall(int nargs, unsigned long *args)
|
||||
{
|
||||
struct audit_aux_data_socketcall *ax;
|
||||
struct audit_context *context = current->audit_context;
|
||||
|
||||
if (likely(!context || context->dummy))
|
||||
return 0;
|
||||
return;
|
||||
|
||||
ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
|
||||
if (!ax)
|
||||
return -ENOMEM;
|
||||
|
||||
ax->nargs = nargs;
|
||||
memcpy(ax->args, args, nargs * sizeof(unsigned long));
|
||||
|
||||
ax->d.type = AUDIT_SOCKETCALL;
|
||||
ax->d.next = context->aux;
|
||||
context->aux = (void *)ax;
|
||||
return 0;
|
||||
context->type = AUDIT_SOCKETCALL;
|
||||
context->socketcall.nargs = nargs;
|
||||
memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -2065,9 +2065,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
|
|||
if (copy_from_user(a, args, nargs[call]))
|
||||
return -EFAULT;
|
||||
|
||||
err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
|
||||
if (err)
|
||||
return err;
|
||||
audit_socketcall(nargs[call] / sizeof(unsigned long), a);
|
||||
|
||||
a0 = a[0];
|
||||
a1 = a[1];
|
||||
|
|
|
|||
Loading…
Reference in a new issue