From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matt Helsley Subject: [PATCH 06/11] Task watchers: Register audit task watcher Date: Tue, 13 Jun 2006 16:54:46 -0700 Message-ID: <1150242886.21787.146.camel@stark> References: <20060613235122.130021000@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: lse-tech-bounces@lists.sourceforge.net Errors-To: lse-tech-bounces@lists.sourceforge.net To: Andrew Morton Cc: Shailabh Nagar , Chandra S Seetharaman , John T Kohl , Balbir Singh , Jes Sorensen , Linux-Kernel , linux-audit@redhat.com, Alan Stern , LSE-Tech , David Woodhouse List-Id: linux-audit@redhat.com Adapt audit to use task watchers. Signed-off-by: Matt Helsley Cc: David Woodhouse Cc: linux-audit@redhat.com -- kernel/audit.c | 25 ++++++++++++++++++++++++- kernel/exit.c | 3 --- kernel/fork.c | 7 +------ 3 files changed, 25 insertions(+), 10 deletions(-) Index: linux-2.6.17-rc5-mm2/kernel/exit.c =================================================================== --- linux-2.6.17-rc5-mm2.orig/kernel/exit.c +++ linux-2.6.17-rc5-mm2/kernel/exit.c @@ -35,11 +35,10 @@ #include #include #include #include #include -#include /* for audit_free() */ #include #include #include #include @@ -914,12 +913,10 @@ fastcall NORET_TYPE void do_exit(long co exit_robust_list(tsk); #ifdef CONFIG_COMPAT if (unlikely(tsk->compat_robust_list)) compat_exit_robust_list(tsk); #endif - if (unlikely(tsk->audit_context)) - audit_free(tsk); tsk->exit_code = code; taskstats_exit_send(tsk, tidstats, tgidstats); taskstats_exit_free(tidstats, tgidstats); delayacct_tsk_exit(tsk); notify_result = notify_watchers(WATCH_TASK_FREE, tsk); Index: linux-2.6.17-rc5-mm2/kernel/audit.c =================================================================== --- linux-2.6.17-rc5-mm2.orig/kernel/audit.c +++ linux-2.6.17-rc5-mm2/kernel/audit.c @@ -46,10 +46,11 @@ #include #include #include #include #include +#include #include #include #include @@ -64,10 +65,30 @@ static int audit_initialized; /* No syscall auditing will take place unless audit_enabled != 0. */ int audit_enabled; +static int audit_task(struct notifier_block *nb, unsigned long val, void *t) +{ + struct task_struct *tsk = t; + + switch(get_watch_event(val)) { + case WATCH_TASK_INIT: + /* Hack: -EFOO sets NOTIFY_STOP_MASK */ + return audit_alloc(tsk); + case WATCH_TASK_FREE: + if (unlikely(tsk->audit_context)) + audit_free(tsk); + default: + return NOTIFY_DONE; + } +} + +static struct notifier_block __read_mostly audit_watch_tasks_nb = { + .notifier_call = audit_task, +}; + /* Default state when kernel boots without any parameters. */ static int audit_default; /* If auditing cannot proceed, audit_failure selects what happens. */ static int audit_failure = AUDIT_FAIL_PRINTK; @@ -707,12 +728,14 @@ static int __init audit_enable(char *str { audit_default = !!simple_strtol(str, NULL, 0); printk(KERN_INFO "audit: %s%s\n", audit_default ? "enabled" : "disabled", audit_initialized ? "" : " (after initialization)"); - if (audit_initialized) + if (audit_initialized) { audit_enabled = audit_default; + register_task_watcher(&audit_watch_tasks_nb); + } return 1; } __setup("audit=", audit_enable); Index: linux-2.6.17-rc5-mm2/kernel/fork.c =================================================================== --- linux-2.6.17-rc5-mm2.orig/kernel/fork.c +++ linux-2.6.17-rc5-mm2/kernel/fork.c @@ -38,11 +38,10 @@ #include #include #include #include #include -#include #include #include #include #include #include @@ -1088,15 +1087,13 @@ static task_t *copy_process(unsigned lon p->softirq_context = 0; #endif if ((retval = security_task_alloc(p))) goto bad_fork_cleanup_policy; - if ((retval = audit_alloc(p))) - goto bad_fork_cleanup_security; /* copy all the process information */ if ((retval = copy_semundo(clone_flags, p))) - goto bad_fork_cleanup_audit; + goto bad_fork_cleanup_security; if ((retval = copy_files(clone_flags, p))) goto bad_fork_cleanup_semundo; if ((retval = copy_fs(clone_flags, p))) goto bad_fork_cleanup_files; if ((retval = copy_sighand(clone_flags, p))) @@ -1270,12 +1267,10 @@ bad_fork_cleanup_fs: exit_fs(p); /* blocking */ bad_fork_cleanup_files: exit_files(p); /* blocking */ bad_fork_cleanup_semundo: exit_sem(p); -bad_fork_cleanup_audit: - audit_free(p); bad_fork_cleanup_security: security_task_free(p); notify_result = notify_watchers(WATCH_TASK_FREE, p); WARN_ON(notify_result & NOTIFY_STOP_MASK); bad_fork_cleanup_policy: --