[PATCH 1/1] audit: Allow auditd to set pid to 0 to end auditing

[PATCH 1/1] audit: Allow auditd to set pid to 0 to end auditing

[Steve Grubb]

The API to end auditing has historically been for auditd to set the
pid to 0. This patch restores that functionality.

Signed-off-by: sgrubb <sgrubb@redhat.com>
---
 kernel/audit.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 6dd556931739..1baabc9539b4 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 			pid_t auditd_pid;
 			struct pid *req_pid = task_tgid(current);
 
-			/* sanity check - PID values must match */
-			if (new_pid != pid_vnr(req_pid))
+			/* Sanity check - PID values must match. A 0
+			 * pid is how auditd normally ends auditing. */
+			if (new_pid && (new_pid != pid_vnr(req_pid)))
 				return -EINVAL;
 
 			/* test the auditd connection */
@@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 			auditd_pid = auditd_pid_vnr();
 			/* only the current auditd can unregister itself */
-			if ((!new_pid) && (new_pid != auditd_pid)) {
+			if (new_pid && auditd_pid && (new_pid != auditd_pid)) {
 				audit_log_config_change("audit_pid", new_pid,
 							auditd_pid, 0);
 				return -EACCES;
-- 
2.13.6

Re: [PATCH 1/1] audit: Allow auditd to set pid to 0 to end auditing

[Richard Guy Briggs]

On 2017-10-13 19:53, Steve Grubb wrote:
> The API to end auditing has historically been for auditd to set the
> pid to 0. This patch restores that functionality.

Please include the issue number:

See: https://github.com/linux-audit/audit-kernel/issues/69

> Signed-off-by: sgrubb <sgrubb@redhat.com>

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  kernel/audit.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 6dd556931739..1baabc9539b4 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
>  			pid_t auditd_pid;
>  			struct pid *req_pid = task_tgid(current);
>  
> -			/* sanity check - PID values must match */
> -			if (new_pid != pid_vnr(req_pid))
> +			/* Sanity check - PID values must match. A 0
> +			 * pid is how auditd normally ends auditing. */
> +			if (new_pid && (new_pid != pid_vnr(req_pid)))
>  				return -EINVAL;
>  
>  			/* test the auditd connection */
> @@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
>  
>  			auditd_pid = auditd_pid_vnr();
>  			/* only the current auditd can unregister itself */
> -			if ((!new_pid) && (new_pid != auditd_pid)) {
> +			if (new_pid && auditd_pid && (new_pid != auditd_pid)) {
>  				audit_log_config_change("audit_pid", new_pid,
>  							auditd_pid, 0);
>  				return -EACCES;
> -- 
> 2.13.6
> 
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

Re: [PATCH 1/1] audit: Allow auditd to set pid to 0 to end auditing

[Paul Moore]

On Fri, Oct 13, 2017 at 3:53 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> The API to end auditing has historically been for auditd to set the
> pid to 0. This patch restores that functionality.
>
> Signed-off-by: sgrubb <sgrubb@redhat.com>
> ---
>  kernel/audit.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 6dd556931739..1baabc9539b4 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
>                         pid_t auditd_pid;
>                         struct pid *req_pid = task_tgid(current);
>
> -                       /* sanity check - PID values must match */
> -                       if (new_pid != pid_vnr(req_pid))
> +                       /* Sanity check - PID values must match. A 0
> +                        * pid is how auditd normally ends auditing. */
> +                       if (new_pid && (new_pid != pid_vnr(req_pid)))
>                                 return -EINVAL;
>
>                         /* test the auditd connection */
> @@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
>
>                         auditd_pid = auditd_pid_vnr();
>                         /* only the current auditd can unregister itself */
> -                       if ((!new_pid) && (new_pid != auditd_pid)) {
> +                       if (new_pid && auditd_pid && (new_pid != auditd_pid)) {

The existing code is definitely not correct, but it looks like your
proposed change is not correct either: the unnegated new_pid check at
the start of the conditional is always going to be false in the
disconnect case (new_pid == 0).  I think the correct fix is something
like below ...

  if (auditd_pid && (!new_pid) && (pid_vnr(req_pid) != auditd_pid))

... and for bonus points, you could probably combine things a bit with
the no-replace check driectly below that code for soemthing like this
...

  if (auditd_pid) {
          if ((!new_pid) && (pid_vnr(req_pid) != auditd_pid)) {
                  /* blah blah, you can't reset someone else's connection */
          }
          if (new_pid) {
                  /* blah blah, you can't replace a healthy connection */
          }
  }

-- 
paul moore
www.paul-moore.com