[PATCH] audit: don't generate loginuid log when audit disabled

[PATCH] audit: don't generate loginuid log when audit disabled

[Gao feng]

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 kernel/auditsc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 065c7a1..92d0e92 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1990,6 +1990,9 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
 	struct audit_buffer *ab;
 	uid_t uid, ologinuid, nloginuid;
 
+	if (audit_enabled == AUDIT_OFF)
+		return;
+
 	uid = from_kuid(&init_user_ns, task_uid(current));
 	ologinuid = from_kuid(&init_user_ns, koldloginuid);
 	nloginuid = from_kuid(&init_user_ns, kloginuid),
-- 
1.8.3.1

Re: [PATCH] audit: don't generate loginuid log when audit disabled

[Steve Grubb]

On Thursday, October 31, 2013 04:52:22 PM Gao feng wrote:
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> ---
>  kernel/auditsc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 065c7a1..92d0e92 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1990,6 +1990,9 @@ static void audit_log_set_loginuid(kuid_t
> koldloginuid, kuid_t kloginuid, struct audit_buffer *ab;
>  	uid_t uid, ologinuid, nloginuid;
> 
> +	if (audit_enabled == AUDIT_OFF)
> +		return;
> +
>  	uid = from_kuid(&init_user_ns, task_uid(current));
>  	ologinuid = from_kuid(&init_user_ns, koldloginuid);
>  	nloginuid = from_kuid(&init_user_ns, kloginuid),

Are you wanting to avoid the audit event or prevent the use of 
loginuid/sessionid when audit is disabled? What if we shutdown auditd (which 
could disable auditing), someone logs in, and we restart auditd? Wouldn't 
their context not have the correct credentials? What about non audit users of 
this information?

-Steve

Re: [PATCH] audit: don't generate loginuid log when audit disabled

[Gao feng]

On 10/31/2013 10:50 PM, Steve Grubb wrote:
> On Thursday, October 31, 2013 04:52:22 PM Gao feng wrote:
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>> ---
>>  kernel/auditsc.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>> index 065c7a1..92d0e92 100644
>> --- a/kernel/auditsc.c
>> +++ b/kernel/auditsc.c
>> @@ -1990,6 +1990,9 @@ static void audit_log_set_loginuid(kuid_t
>> koldloginuid, kuid_t kloginuid, struct audit_buffer *ab;
>>  	uid_t uid, ologinuid, nloginuid;
>>
>> +	if (audit_enabled == AUDIT_OFF)
>> +		return;
>> +
>>  	uid = from_kuid(&init_user_ns, task_uid(current));
>>  	ologinuid = from_kuid(&init_user_ns, koldloginuid);
>>  	nloginuid = from_kuid(&init_user_ns, kloginuid),
> 
> Are you wanting to avoid the audit event or prevent the use of 
> loginuid/sessionid when audit is disabled? What if we shutdown auditd (which 
> could disable auditing), someone logs in, and we restart auditd? Wouldn't 
> their context not have the correct credentials? What about non audit users of 
> this information?
> 

audit_log_set_loginuid is just used to log the setting loginuid message.
this patch will prevent this message being generated when audit is disabled,
we can still set/use loginuid.

Anything I missed?

Thanks
Gao

Re: [PATCH] audit: don't generate loginuid log when audit disabled

[Steve Grubb]

On Friday, November 01, 2013 08:55:03 AM Gao feng wrote:
> On 10/31/2013 10:50 PM, Steve Grubb wrote:
> > On Thursday, October 31, 2013 04:52:22 PM Gao feng wrote:
> >> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> >> ---
> >> 
> >>  kernel/auditsc.c | 3 +++
> >>  1 file changed, 3 insertions(+)
> >> 
> >> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> >> index 065c7a1..92d0e92 100644
> >> --- a/kernel/auditsc.c
> >> +++ b/kernel/auditsc.c
> >> @@ -1990,6 +1990,9 @@ static void audit_log_set_loginuid(kuid_t
> >> koldloginuid, kuid_t kloginuid, struct audit_buffer *ab;
> >> 
> >>  	uid_t uid, ologinuid, nloginuid;
> >> 
> >> +	if (audit_enabled == AUDIT_OFF)
> >> +		return;
> >> +
> >> 
> >>  	uid = from_kuid(&init_user_ns, task_uid(current));
> >>  	ologinuid = from_kuid(&init_user_ns, koldloginuid);
> >>  	nloginuid = from_kuid(&init_user_ns, kloginuid),
> > 
> > Are you wanting to avoid the audit event or prevent the use of
> > loginuid/sessionid when audit is disabled? What if we shutdown auditd
> > (which could disable auditing), someone logs in, and we restart auditd?
> > Wouldn't their context not have the correct credentials? What about non
> > audit users of this information?
> 
> audit_log_set_loginuid is just used to log the setting loginuid message.
> this patch will prevent this message being generated when audit is disabled,
> we can still set/use loginuid.

OK, good. The version of that function I looked at sets the value (3.11 
kernel). So, I wanted to make sure we are still able to set the value.

-Steve

[PATCH] audit: don't generate loginuid log when audit disabled

[Richard Guy Briggs]

From: Gao feng <gaofeng@cn.fujitsu.com>

If audit is disabled, we shouldn't generate loginuid audit
log.

Cc: stable@vger.kernel.org # v3.13-rc1
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

Already upstream in 3.14-rc1.  This fixes a bug introduced by:
	da0a6104 audit: loginuid functions coding style


 kernel/auditsc.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index df1e685..9ab02fa 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1971,6 +1971,9 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
 	struct audit_buffer *ab;
 	uid_t uid, ologinuid, nloginuid;
 
+	if (!audit_enabled)
+		return;
+
 	uid = from_kuid(&init_user_ns, task_uid(current));
 	ologinuid = from_kuid(&init_user_ns, koldloginuid);
 	nloginuid = from_kuid(&init_user_ns, kloginuid),
-- 
1.7.1

Re: [PATCH] audit: don't generate loginuid log when audit disabled

[Greg KH]

On Mon, Mar 03, 2014 at 05:30:50PM -0500, Richard Guy Briggs wrote:
> From: Gao feng <gaofeng@cn.fujitsu.com>
> 
> If audit is disabled, we shouldn't generate loginuid audit
> log.
> 
> Cc: stable@vger.kernel.org # v3.13-rc1
> Acked-by: Eric Paris <eparis@redhat.com>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> Signed-off-by: Eric Paris <eparis@redhat.com>
> ---
> 
> Already upstream in 3.14-rc1.  This fixes a bug introduced by:
> 	da0a6104 audit: loginuid functions coding style

What is the git id of the patch in Linus's tree?

thanks,

greg k-h

Re: [PATCH] audit: don't generate loginuid log when audit disabled

[Richard Guy Briggs]

On 14/03/03, Greg KH wrote:
> On Mon, Mar 03, 2014 at 05:30:50PM -0500, Richard Guy Briggs wrote:
> > From: Gao feng <gaofeng@cn.fujitsu.com>
> > 
> > If audit is disabled, we shouldn't generate loginuid audit
> > log.
> > 
> > Cc: stable@vger.kernel.org # v3.13-rc1
> > Acked-by: Eric Paris <eparis@redhat.com>
> > Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > ---
> > 
> > Already upstream in 3.14-rc1.  This fixes a bug introduced by:
> > 	da0a6104 audit: loginuid functions coding style
> 
> What is the git id of the patch in Linus's tree?

Sorry, here you go: c2412d9

> greg k-h

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545