[PATCH] add uid and comm to OBJ_PID records

[Eric Paris <eparis@redhat.com>]

Add uid and comm collection to OBJ_PID records.  This information was
ask for by RHEL users who wanted a better idea where signals were ending
up.

Signed-off-by: Eric Paris <eparis@redhat.com>

---

#kill a program running as a different user in a different domain
type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018  obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop 
type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64 syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189 pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) 

## custom program which fork() 2 children, puts them in a grp and kills the grp.
type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976  obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp 
type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975  obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp 
type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64 syscall=kill success=yes exit=0 a0=fffff461 a1=9 a2=0 a3=0 items=0 ppid=2194 pid=2974 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=tmp exe=/tmp/tmp subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)

 kernel/auditsc.c |   21 ++++++++++++++++++---
 1 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index bce9ecd..dcedbb0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair {
 struct audit_aux_data_pids {
 	struct audit_aux_data	d;
 	pid_t			target_pid[AUDIT_AUX_PIDS];
+	pid_t			target_uid[AUDIT_AUX_PIDS];
 	u32			target_sid[AUDIT_AUX_PIDS];
+	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
 	int			pid_count;
 };
 
@@ -215,7 +217,9 @@ struct audit_context {
 	int		    arch;
 
 	pid_t		    target_pid;
+	pid_t		    target_uid;
 	u32		    target_sid;
+	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;
 	int tree_count;
@@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
 }
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
-				 u32 sid)
+				 u32 sid, pid_t uid, char *comm)
 {
 	struct audit_buffer *ab;
 	char *s = NULL;
@@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
 		rc = 1;
 	} else
 		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
+	audit_log_format(ab, " uid=%d comm=", uid);
+	audit_log_untrustedstring(ab, comm);
 	audit_log_end(ab);
 	kfree(s);
 
@@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
 		for (i = 0; i < axs->pid_count; i++)
 			if (audit_log_pid_context(context, axs->target_pid[i],
-						  axs->target_sid[i]))
+						  axs->target_sid[i],
+						  axs->target_uid[i],
+						  axs->target_comm[i]))
 				call_panic = 1;
 	}
 
 	if (context->target_pid &&
 	    audit_log_pid_context(context, context->target_pid,
-				  context->target_sid))
+				  context->target_sid, context->target_uid,
+				  context->target_comm))
 			call_panic = 1;
 
 	if (context->pwd && context->pwdmnt) {
@@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t)
 
 	context->target_pid = t->pid;
 	selinux_get_task_sid(t, &context->target_sid);
+	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
+	context->target_uid = t->uid;
 }
 
 /**
@@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 	if (!ctx->target_pid) {
 		ctx->target_pid = t->tgid;
 		selinux_get_task_sid(t, &ctx->target_sid);
+		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
+		ctx->target_uid = t->uid;
 		return 0;
 	}
 
@@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
 	axp->target_pid[axp->pid_count] = t->tgid;
 	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
+	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
+	axp->target_uid[axp->pid_count] = t->uid;
 	axp->pid_count++;
 
 	return 0;