Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

audit: create private file name copies when auditing inodes

Browse source 
Unfortunately, while commit 4a928436 ("audit: correctly record file
names with different path name types") fixed a problem where we were
not recording filenames, it created a new problem by attempting to use
these file names after they had been freed.  This patch resolves the
issue by creating a copy of the filename which the audit subsystem
frees after it is done with the string.

At some point it would be nice to resolve this issue with refcounts,
or something similar, instead of having to allocate/copy strings, but
that is almost surely beyond the scope of a -rcX patch so we'll defer
that for later.  On the plus side, only audit users should be impacted
by the string copying.

Reported-by: Toralf Foerster <toralf.foerster@gmx.de>
Signed-off-by: Paul Moore <pmoore@redhat.com>
This commit is contained in:
Paul Moore 2014-12-30 09:26:21 -05:00
parent 041d7b98ff
commit fcf22d8267
1 changed files with 40 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
kernel/auditsc.c
View file

@ -72,6 +72,8 @@
#include <linux/fs_struct.h> #include <linux/fs_struct.h>
#include <linux/compat.h> #include <linux/compat.h>
#include <linux/ctype.h> #include <linux/ctype.h>
#include <linux/string.h>
#include <uapi/linux/limits.h>
#include "audit.h" #include "audit.h"
@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
} }
list_for_each_entry_reverse(n, &context->names_list, list) { list_for_each_entry_reverse(n, &context->names_list, list) {
/* does the name pointer match? */ if (!n->name || strcmp(n->name->name, name->name))
if (!n->name || n->name->name != name->name)
continue; continue;
/* match the correct record type */ /* match the correct record type */
@ -1881,14 +1882,44 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN); n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
if (!n) if (!n)
return; return;
if (name) /* unfortunately, while we may have a path name to record with the
/* since name is not NULL we know there is already a matching * inode, we can't always rely on the string lasting until the end of
* name record, see audit_getname(), so there must be a type * the syscall so we need to create our own copy, it may fail due to
* mismatch; reuse the string path since the original name * memory allocation issues, but we do our best */
* record will keep the string valid until we free it in if (name) {
* audit_free_names() */ /* we can't use getname_kernel() due to size limits */
n->name = name; size_t len = strlen(name->name) + 1;
struct filename *new = __getname();
if (unlikely(!new))
goto out;
if (len <= (PATH_MAX - sizeof(*new))) {
new->name = (char *)(new) + sizeof(*new);
new->separate = false;
} else if (len <= PATH_MAX) {
/* this looks odd, but is due to final_putname() */
struct filename *new2;
new2 = kmalloc(sizeof(*new2), GFP_KERNEL);
if (unlikely(!new2)) {
__putname(new);
goto out;
}
new2->name = (char *)new;
new2->separate = true;
new = new2;
} else {
/* we should never get here, but let's be safe */
__putname(new);
goto out;
}
strlcpy((char *)new->name, name->name, len);
new->uptr = NULL;
new->aname = n;
n->name = new;
n->name_put = true;
}
out: out:
if (parent) { if (parent) {
n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL; n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;