* [PATCH] audit: handle unknown status requests in audit_receive_msg
@ 2026-03-03 12:42 Ricardo Robaina
2026-03-06 3:22 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Ricardo Robaina @ 2026-03-03 12:42 UTC (permalink / raw)
To: audit, linux-kernel; +Cc: paul, eparis, sgrubb, Ricardo Robaina
Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET
requests, incorrectly returning success to newer user space tools
querying unsupported features. This breaks forward compatibility.
Fix this by defining AUDIT_STATUS_ALL in the UAPI header and returning
-EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL).
This ensures invalid requests are safely rejected, allowing user space
to reliably test for and gracefully handle feature detection on older
kernels.
Suggested-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
include/uapi/linux/audit.h | 9 +++++++++
kernel/audit.c | 2 ++
2 files changed, 11 insertions(+)
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 14a1c1fe013a..1d5122b9274a 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -356,6 +356,15 @@ enum {
#define AUDIT_STATUS_LOST 0x0040
#define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL 0x0080
+#define AUDIT_STATUS_ALL (AUDIT_STATUS_ENABLED | \
+ AUDIT_STATUS_FAILURE | \
+ AUDIT_STATUS_PID | \
+ AUDIT_STATUS_RATE_LIMIT | \
+ AUDIT_STATUS_BACKLOG_LIMIT | \
+ AUDIT_STATUS_BACKLOG_WAIT_TIME | \
+ AUDIT_STATUS_LOST | \
+ AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL)
+
#define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
#define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
#define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
diff --git a/kernel/audit.c b/kernel/audit.c
index 5a0216056524..592383dce090 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1295,6 +1295,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
memset(&s, 0, sizeof(s));
/* guard against past and future API changes */
memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
+ if (s.mask & ~AUDIT_STATUS_ALL)
+ return -EINVAL;
if (s.mask & AUDIT_STATUS_ENABLED) {
err = audit_set_enabled(s.enabled);
if (err < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] audit: handle unknown status requests in audit_receive_msg
2026-03-03 12:42 [PATCH] audit: handle unknown status requests in audit_receive_msg Ricardo Robaina
@ 2026-03-06 3:22 ` Paul Moore
2026-03-09 12:24 ` Ricardo Robaina
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2026-03-06 3:22 UTC (permalink / raw)
To: Ricardo Robaina; +Cc: audit, linux-kernel, eparis, sgrubb
On Tue, Mar 3, 2026 at 7:42 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
>
> Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET
> requests, incorrectly returning success to newer user space tools
> querying unsupported features. This breaks forward compatibility.
>
> Fix this by defining AUDIT_STATUS_ALL in the UAPI header and returning
> -EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL).
> This ensures invalid requests are safely rejected, allowing user space
> to reliably test for and gracefully handle feature detection on older
> kernels.
>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
> include/uapi/linux/audit.h | 9 +++++++++
> kernel/audit.c | 2 ++
> 2 files changed, 11 insertions(+)
>
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 14a1c1fe013a..1d5122b9274a 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -356,6 +356,15 @@ enum {
> #define AUDIT_STATUS_LOST 0x0040
> #define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL 0x0080
>
> +#define AUDIT_STATUS_ALL (AUDIT_STATUS_ENABLED | \
> + AUDIT_STATUS_FAILURE | \
> + AUDIT_STATUS_PID | \
> + AUDIT_STATUS_RATE_LIMIT | \
> + AUDIT_STATUS_BACKLOG_LIMIT | \
> + AUDIT_STATUS_BACKLOG_WAIT_TIME | \
> + AUDIT_STATUS_LOST | \
> + AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL)
Overall I think this is fine and good, but AUDIT_STATUS_ALL doesn't
need to be in the UAPI so why don't we move it to
include/linux/audit.h? You can put it at the very top, right above
the AUDIT_INO_UNSET macro.
> #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
> #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
> #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 5a0216056524..592383dce090 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1295,6 +1295,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
> memset(&s, 0, sizeof(s));
> /* guard against past and future API changes */
> memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
> + if (s.mask & ~AUDIT_STATUS_ALL)
> + return -EINVAL;
> if (s.mask & AUDIT_STATUS_ENABLED) {
> err = audit_set_enabled(s.enabled);
> if (err < 0)
> --
> 2.53.0
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] audit: handle unknown status requests in audit_receive_msg
2026-03-06 3:22 ` Paul Moore
@ 2026-03-09 12:24 ` Ricardo Robaina
0 siblings, 0 replies; 3+ messages in thread
From: Ricardo Robaina @ 2026-03-09 12:24 UTC (permalink / raw)
To: Paul Moore; +Cc: audit, linux-kernel, eparis, sgrubb
On Fri, Mar 6, 2026 at 12:22 AM Paul Moore <paul@paul-moore.com> wrote:
>
> On Tue, Mar 3, 2026 at 7:42 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET
> > requests, incorrectly returning success to newer user space tools
> > querying unsupported features. This breaks forward compatibility.
> >
> > Fix this by defining AUDIT_STATUS_ALL in the UAPI header and returning
> > -EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL).
> > This ensures invalid requests are safely rejected, allowing user space
> > to reliably test for and gracefully handle feature detection on older
> > kernels.
> >
> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> > include/uapi/linux/audit.h | 9 +++++++++
> > kernel/audit.c | 2 ++
> > 2 files changed, 11 insertions(+)
> >
> > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> > index 14a1c1fe013a..1d5122b9274a 100644
> > --- a/include/uapi/linux/audit.h
> > +++ b/include/uapi/linux/audit.h
> > @@ -356,6 +356,15 @@ enum {
> > #define AUDIT_STATUS_LOST 0x0040
> > #define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL 0x0080
> >
> > +#define AUDIT_STATUS_ALL (AUDIT_STATUS_ENABLED | \
> > + AUDIT_STATUS_FAILURE | \
> > + AUDIT_STATUS_PID | \
> > + AUDIT_STATUS_RATE_LIMIT | \
> > + AUDIT_STATUS_BACKLOG_LIMIT | \
> > + AUDIT_STATUS_BACKLOG_WAIT_TIME | \
> > + AUDIT_STATUS_LOST | \
> > + AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL)
>
> Overall I think this is fine and good, but AUDIT_STATUS_ALL doesn't
> need to be in the UAPI so why don't we move it to
> include/linux/audit.h? You can put it at the very top, right above
> the AUDIT_INO_UNSET macro.
>
Thanks for reviewing this patch, Paul! Sounds like a good idea, I'll
work on the V2.
> > #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
> > #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
> > #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index 5a0216056524..592383dce090 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -1295,6 +1295,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
> > memset(&s, 0, sizeof(s));
> > /* guard against past and future API changes */
> > memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
> > + if (s.mask & ~AUDIT_STATUS_ALL)
> > + return -EINVAL;
> > if (s.mask & AUDIT_STATUS_ENABLED) {
> > err = audit_set_enabled(s.enabled);
> > if (err < 0)
> > --
> > 2.53.0
>
> --
> paul-moore.com
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-09 12:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-03 12:42 [PATCH] audit: handle unknown status requests in audit_receive_msg Ricardo Robaina
2026-03-06 3:22 ` Paul Moore
2026-03-09 12:24 ` Ricardo Robaina
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox