From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff Vander Stoep Subject: [PATCH] security: lsm_audit: print pid and tid Date: Tue, 26 Jul 2016 07:54:30 -0700 Message-ID: <1469544870-11574-1-git-send-email-jeffv@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx09.extmail.prod.ext.phx2.redhat.com [10.5.110.38]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u6QEsjf4017847 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 26 Jul 2016 10:54:45 -0400 Received: from mail-pa0-f52.google.com (mail-pa0-f52.google.com [209.85.220.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8EADB65743 for ; Tue, 26 Jul 2016 14:54:35 +0000 (UTC) Received: by mail-pa0-f52.google.com with SMTP id fi15so586864pac.1 for ; Tue, 26 Jul 2016 07:54:35 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: selinux@tycho.nsa.gov Cc: Jeff Vander Stoep , linux-audit@redhat.com List-Id: linux-audit@redhat.com dump_common_audit_data() currently contains a field for pid, but the value printed is actually the thread ID, tid. Update this value to return the task group ID. Add a new field for tid. With this change the values printed by audit now match the values returned by the getpid() and gettid() syscalls. Signed-off-by: Jeff Vander Stoep --- security/lsm_audit.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/security/lsm_audit.c b/security/lsm_audit.c index cccbf30..57f26c1 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -220,7 +220,8 @@ static void dump_common_audit_data(struct audit_buffer *ab, */ BUILD_BUG_ON(sizeof(a->u) > sizeof(void *)*2); - audit_log_format(ab, " pid=%d comm=", task_pid_nr(current)); + audit_log_format(ab, " pid=%d tid=%d comm=", task_tgid_vnr(tsk), + task_pid_vnr(tsk)); audit_log_untrustedstring(ab, memcpy(comm, current->comm, sizeof(comm))); switch (a->type) { @@ -294,10 +295,12 @@ static void dump_common_audit_data(struct audit_buffer *ab, case LSM_AUDIT_DATA_TASK: { struct task_struct *tsk = a->u.tsk; if (tsk) { - pid_t pid = task_pid_nr(tsk); + pid_t pid = task_tgid_vnr(tsk); if (pid) { char comm[sizeof(tsk->comm)]; audit_log_format(ab, " opid=%d ocomm=", pid); + audit_log_format(ab, " opid=%d otid=%d ocomm=", + pid, task_pid_vnr(tsk)); audit_log_untrustedstring(ab, memcpy(comm, tsk->comm, sizeof(comm))); } -- 2.8.0.rc3.226.g39d4020 From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u6QEt8T5016492 for ; Tue, 26 Jul 2016 10:55:08 -0400 Received: by mail-pa0-f48.google.com with SMTP id ks6so595647pab.0 for ; Tue, 26 Jul 2016 07:54:48 -0700 (PDT) From: Jeff Vander Stoep To: selinux@tycho.nsa.gov Cc: paul@paul-moore.com, linux-audit@redhat.com, Jeff Vander Stoep Subject: [PATCH] security: lsm_audit: print pid and tid Date: Tue, 26 Jul 2016 07:54:30 -0700 Message-Id: <1469544870-11574-1-git-send-email-jeffv@google.com> List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: dump_common_audit_data() currently contains a field for pid, but the value printed is actually the thread ID, tid. Update this value to return the task group ID. Add a new field for tid. With this change the values printed by audit now match the values returned by the getpid() and gettid() syscalls. Signed-off-by: Jeff Vander Stoep --- security/lsm_audit.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/security/lsm_audit.c b/security/lsm_audit.c index cccbf30..57f26c1 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -220,7 +220,8 @@ static void dump_common_audit_data(struct audit_buffer *ab, */ BUILD_BUG_ON(sizeof(a->u) > sizeof(void *)*2); - audit_log_format(ab, " pid=%d comm=", task_pid_nr(current)); + audit_log_format(ab, " pid=%d tid=%d comm=", task_tgid_vnr(tsk), + task_pid_vnr(tsk)); audit_log_untrustedstring(ab, memcpy(comm, current->comm, sizeof(comm))); switch (a->type) { @@ -294,10 +295,12 @@ static void dump_common_audit_data(struct audit_buffer *ab, case LSM_AUDIT_DATA_TASK: { struct task_struct *tsk = a->u.tsk; if (tsk) { - pid_t pid = task_pid_nr(tsk); + pid_t pid = task_tgid_vnr(tsk); if (pid) { char comm[sizeof(tsk->comm)]; audit_log_format(ab, " opid=%d ocomm=", pid); + audit_log_format(ab, " opid=%d otid=%d ocomm=", + pid, task_pid_vnr(tsk)); audit_log_untrustedstring(ab, memcpy(comm, tsk->comm, sizeof(comm))); } -- 2.8.0.rc3.226.g39d4020