From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: [PATCH 1/1] audit: Allow auditd to set pid to 0 to end auditing Date: Fri, 13 Oct 2017 15:53:34 -0400 Message-ID: <3303395.MqHatjEQAP@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from x2.localnet (ovpn-124-104.rdu2.redhat.com [10.10.124.104]) by smtp.corp.redhat.com (Postfix) with ESMTPS id A5D795C462 for ; Fri, 13 Oct 2017 19:53:35 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com The API to end auditing has historically been for auditd to set the pid to 0. This patch restores that functionality. Signed-off-by: sgrubb --- kernel/audit.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 6dd556931739..1baabc9539b4 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1197,8 +1197,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) pid_t auditd_pid; struct pid *req_pid = task_tgid(current); - /* sanity check - PID values must match */ - if (new_pid != pid_vnr(req_pid)) + /* Sanity check - PID values must match. A 0 + * pid is how auditd normally ends auditing. */ + if (new_pid && (new_pid != pid_vnr(req_pid))) return -EINVAL; /* test the auditd connection */ @@ -1206,7 +1207,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) auditd_pid = auditd_pid_vnr(); /* only the current auditd can unregister itself */ - if ((!new_pid) && (new_pid != auditd_pid)) { + if (new_pid && auditd_pid && (new_pid != auditd_pid)) { audit_log_config_change("audit_pid", new_pid, auditd_pid, 0); return -EACCES; -- 2.13.6