[PATCH 7/7] audit: audit feature to set loginuid immutable

Eric Paris
2013-05-24T16:11:50Z

This adds a new 'audit_feature' bit which allows userspace to set it
such that the loginuid is absolutely immutable, even if you have
CAP_AUDIT_CONTROL.

Signed-off-by: Eric Paris <eparis@redhat.com>
---
include/uapi/linux/audit.h | 3 ++-
kernel/audit.c | 3 ++-
kernel/auditsc.c | 3 +++
3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 2963b5a..9539ea9 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -381,7 +381,8 @@ struct audit_features {
};

#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0
-#define AUDIT_LAST_FEATURE AUDIT_FEATURE_ONLY_UNSET_LOGINUID
+#define AUDIT_FEATURE_LOGINUID_IMMUTABLE 1
+#define AUDIT_LAST_FEATURE AUDIT_FEATURE_LOGINUID_IMMUTABLE

#define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE)
#define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */
diff --git a/kernel/audit.c b/kernel/audit.c
index a5c470b..900d61d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -145,8 +145,9 @@ static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
.features = 0,
.lock = 0,};

-static char *audit_feature_names[1] = {
+static char *audit_feature_names[2] = {
"only_unset_loginuid",
+ "loginuid_immutable",
};

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e5dbbc6..aace3ac 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1969,6 +1969,9 @@ static int audit_set_loginuid_perm(kuid_t loginuid)
/* if we are unset, we don't need privs */
if (!audit_loginuid_set(current))
return 0;
+ /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
+ if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
+ return -EPERM;
/* it is set, you need permission */
if (!capable(CAP_AUDIT_CONTROL))
return -EPERM;
--
1.8.2.1