From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: Re: [PATCH] Audit of POSIX Message Queue Syscalls Date: Wed, 17 May 2006 12:39:28 -0400 Message-ID: <20060517163928.GA30925@zk3.dec.com> References: <20060517014055.GA16852@us.ibm.com> <200605170934.46091.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k4HGdfRk019910 for ; Wed, 17 May 2006 12:39:41 -0400 Received: from palrel13.hp.com (palrel13.hp.com [156.153.255.238]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k4HGdYeu019856 for ; Wed, 17 May 2006 12:39:34 -0400 Received: from cacrelint01.ptp.hp.com (cacrelint01.ptp.hp.com [15.1.29.21]) by palrel13.hp.com (Postfix) with ESMTP id 4271034320 for ; Wed, 17 May 2006 09:39:29 -0700 (PDT) Received: from dill.zko.hp.com (dill.zko.hp.com [16.116.96.242]) by cacrelint01.ptp.hp.com (Postfix) with ESMTP id 0529034088 for ; Wed, 17 May 2006 09:39:29 -0700 (PDT) Content-Disposition: inline In-Reply-To: <200605170934.46091.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, May 17, 2006 at 09:34:46AM -0400, Steve Grubb wrote: > > @@ -1242,6 +1313,187 @@ uid_t audit_get_loginuid(struct audit_co > > } > > > > /** > > + * audit_mq_open - record audit data for a POSIX MQ open > > + * @oflag: open flag > > + * @mode: mode bits > > + * @u_attr: queue attributes > > + * > > + * Returns 0 for success or NULL context or < 0 on error. > > + */ > > +int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr) > > +{ > > + struct audit_aux_data_mq_open *ax; > > + struct audit_context *context = current->audit_context; > > + > > + if (likely(!context)) > > + return 0; > > What if audit is not enabled? Need to check for it and bail out. The audit_enabled flag is only checked once during syscall processing, in audit_syscall_entry. Once we've made the decision to audit a syscall, we don't re-check. If audit_enabled was 0 in audit_syscall_entry, then context->in_syscall will be 0. The latter is what you should check along with !context. Looking through the code, I see that audit_getname, audit_inode and friends do both checks, while the other aux data collectors only check !context. Looks like someone should add the second check for those also (except maybe audit_avc_path). IIRC, we want the avc path records even when syscall auditing is disabled. Amy