Re: [PATCH] Audit of POSIX Message Queue Syscalls

[Amy Griffis <amy.griffis@hp.com>]

On Wed, May 17, 2006 at 09:34:46AM -0400, Steve Grubb wrote:
> > @@ -1242,6 +1313,187 @@ uid_t audit_get_loginuid(struct audit_co
> >  }
> >
> >  /**
> > + * audit_mq_open - record audit data for a POSIX MQ open
> > + * @oflag: open flag
> > + * @mode: mode bits
> > + * @u_attr: queue attributes
> > + *
> > + * Returns 0 for success or NULL context or < 0 on error.
> > + */
> > +int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
> > +{
> > +	struct audit_aux_data_mq_open *ax;
> > +	struct audit_context *context = current->audit_context;
> > +
> > +	if (likely(!context))
> > +		return 0;
> 
> What if audit is not enabled? Need to check for it and bail out.

The audit_enabled flag is only checked once during syscall processing,
in audit_syscall_entry.  Once we've made the decision to audit a
syscall, we don't re-check.

If audit_enabled was 0 in audit_syscall_entry, then
context->in_syscall will be 0.  The latter is what you should check
along with !context.

Looking through the code, I see that audit_getname, audit_inode and
friends do both checks, while the other aux data collectors only check
!context.  Looks like someone should add the second check for those
also (except maybe audit_avc_path).  IIRC, we want the avc path
records even when syscall auditing is disabled.

Amy