This is a note to let you know that I've just added the patch titled
audit: don't attempt to lookup PIDs when changing PID filtering audit rules
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
audit-don-t-attempt-to-lookup-pids-when-changing-pid-filtering-audit-rules.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 3640dcfa4fd00cd91d88bb86250bdb496f7070c0 Mon Sep 17 00:00:00 2001
From: Paul Moore <pmoore@xxxxxxxxxx>
Date: Fri, 19 Dec 2014 18:35:53 -0500
Subject: audit: don't attempt to lookup PIDs when changing PID filtering audit rules
From: Paul Moore <pmoore@xxxxxxxxxx>
commit 3640dcfa4fd00cd91d88bb86250bdb496f7070c0 upstream.
Commit f1dc4867 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system. The following commands demonstrate a simple
reproducer.
# auditctl -D
# auditctl -l
# autrace /bin/true
# auditctl -l
This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.
Cc: Richard Guy Briggs <rgb@xxxxxxxxxx>
Signed-off-by: Paul Moore <pmoore@xxxxxxxxxx>
Acked-by: Eric Paris <eparis@xxxxxxxxxx>
Reviewed-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/auditfilter.c | 13 -------------
1 file changed, 13 deletions(-)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -444,19 +444,6 @@ static struct audit_entry *audit_data_to
f->val = 0;
}
- if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
- struct pid *pid;
- rcu_read_lock();
- pid = find_vpid(f->val);
- if (!pid) {
- rcu_read_unlock();
- err = -ESRCH;
- goto exit_free;
- }
- f->val = pid_nr(pid);
- rcu_read_unlock();
- }
-
err = audit_field_valid(entry, f);
if (err)
goto exit_free;
Patches currently in stable-queue which might be from pmoore@xxxxxxxxxx are
queue-3.18/audit-restore-audit_loginuid-unset-abi.patch
queue-3.18/audit-don-t-attempt-to-lookup-pids-when-changing-pid-filtering-audit-rules.patch
queue-3.18/audit-use-supplied-gfp_mask-from-audit_buffer-in-kauditd_send_multicast_skb.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html