[PATCH 1/1] additional ipsec audit patch

[PATCH 1/1] additional ipsec audit patch

[Joy Latten]

This patch disables auditing in ipsec when CONFIG_AUDITSYSCALL is
disabled in the kernel. 

This patch also includes a bug fix for xfrm_state.c as a result of
original ipsec audit patch.

Let me know if it looks ok.

My mail gateway has been acting crazy so I apologize for any
replicas being sent for ipsec audit patches.

regards,
Joy

diff -urpN linux-2.6.18-patch/include/net/xfrm.h linux-2.6.18-patch.2/include/net/xfrm.h
--- linux-2.6.18-patch/include/net/xfrm.h	2006-11-27 12:29:11.000000000 -0600
+++ linux-2.6.18-patch.2/include/net/xfrm.h	2006-11-28 13:26:49.000000000 -0600
@@ -395,8 +395,13 @@ struct xfrm_audit
 	uid_t	loginuid;
 	u32	secid;
 };
-void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
+
+#ifdef CONFIG_AUDITSYSCALL
+extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
 		    struct xfrm_policy *xp, struct xfrm_state *x);
+#else
+#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#endif /* CONFIG_AUDITSYSCALL */
 
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 {
diff -urpN linux-2.6.18-patch/net/xfrm/xfrm_policy.c linux-2.6.18-patch.2/net/xfrm/xfrm_policy.c
--- linux-2.6.18-patch/net/xfrm/xfrm_policy.c	2006-11-27 12:29:33.000000000 -0600
+++ linux-2.6.18-patch.2/net/xfrm/xfrm_policy.c	2006-11-28 14:51:09.000000000 -0600
@@ -1955,6 +1955,7 @@ int xfrm_bundle_ok(struct xfrm_policy *p
 
 EXPORT_SYMBOL(xfrm_bundle_ok);
 
+#ifdef CONFIG_AUDITSYSCALL
 /* Audit addition and deletion of SAs and ipsec policy */
 
 void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
@@ -2063,6 +2064,7 @@ void xfrm_audit_log(uid_t auid, u32 sid,
 }
 
 EXPORT_SYMBOL(xfrm_audit_log);
+#endif /* CONFIG_AUDITSYSCALL */
 
 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
 {
diff -urpN linux-2.6.18-patch/net/xfrm/xfrm_state.c linux-2.6.18-patch.2/net/xfrm/xfrm_state.c
--- linux-2.6.18-patch/net/xfrm/xfrm_state.c	2006-11-27 12:29:33.000000000 -0600
+++ linux-2.6.18-patch.2/net/xfrm/xfrm_state.c	2006-11-28 12:58:56.000000000 -0600
@@ -407,7 +407,6 @@ restart:
 				xfrm_state_hold(x);
 				spin_unlock_bh(&xfrm_state_lock);
 
-				xfrm_state_delete(x);
 				err = xfrm_state_delete(x);
 				xfrm_audit_log(audit_info->loginuid,
 					       audit_info->secid,

Re: [PATCH 1/1] additional ipsec audit patch

[James Morris]

On Wed, 29 Nov 2006, Joy Latten wrote:

> This patch disables auditing in ipsec when CONFIG_AUDITSYSCALL is
> disabled in the kernel. 
> 
> This patch also includes a bug fix for xfrm_state.c as a result of
> original ipsec audit patch.
> 
> Let me know if it looks ok.


Also, the last patch contains no Signed-off-by: line, please resend.


-- 
James Morris
<jmorris@namei.org>

Re: [PATCH 1/1] additional ipsec audit patch

[James Morris]

On Wed, 29 Nov 2006, James Morris wrote:

> On Wed, 29 Nov 2006, Joy Latten wrote:
> 
> > This patch disables auditing in ipsec when CONFIG_AUDITSYSCALL is
> > disabled in the kernel. 
> > 
> > This patch also includes a bug fix for xfrm_state.c as a result of
> > original ipsec audit patch.
> > 
> > Let me know if it looks ok.
> 
> 
> Also, the last patch contains no Signed-off-by: line, please resend.

And, what is the testing status of these patches?


-- 
James Morris
<jmorris@namei.org>

Re: [PATCH 1/1] additional ipsec audit patch

[Joy Latten]

On Wed, 2006-11-29 at 19:32 -0500, James Morris wrote:
> On Wed, 29 Nov 2006, James Morris wrote:
> 
> > On Wed, 29 Nov 2006, Joy Latten wrote:
> > 
> > > This patch disables auditing in ipsec when CONFIG_AUDITSYSCALL is
> > > disabled in the kernel. 
> > > 
> > > This patch also includes a bug fix for xfrm_state.c as a result of
> > > original ipsec audit patch.
> > > 
> > > Let me know if it looks ok.
> > 
> > 
> > Also, the last patch contains no Signed-off-by: line, please resend.
> 
> And, what is the testing status of these patches?
> 
I ran a stress test overnight using labeled ipsec on a patched lspp55 kernel 
using racoon last week.

The additional patch to xfrm_state.c was my fault when rebasing to
2.6.19-rc6 to send upstream. I plan to run an ipv4 and ipv6 stress test
tonight and tomorrow using labeled ipsec with auditing enabled on the
lspp56 kernel, which contains ipsec audit patch, to ensure no regression
has occurred. I can also run an ipv4 and ipv6 stress tests
with regular ipsec over the weekend for further ensurance.   

I compiled and did unit test with SELINUX disabled, AUDITSYSCALL
disabled, and with both enabled. 

regards,
Joy

Re: [PATCH 1/1] additional ipsec audit patch

[James Morris]

On Thu, 30 Nov 2006, Joy Latten wrote:

> I ran a stress test overnight using labeled ipsec on a patched lspp55 kernel 
> using racoon last week.
> 
> The additional patch to xfrm_state.c was my fault when rebasing to
> 2.6.19-rc6 to send upstream. I plan to run an ipv4 and ipv6 stress test
> tonight and tomorrow using labeled ipsec with auditing enabled on the
> lspp56 kernel, which contains ipsec audit patch, to ensure no regression
> has occurred. I can also run an ipv4 and ipv6 stress tests
> with regular ipsec over the weekend for further ensurance.   
> 
> I compiled and did unit test with SELINUX disabled, AUDITSYSCALL
> disabled, and with both enabled. 

Thanks, applied to 

git://git.infradead.org/~jmorris/selinux-net-2.6.20#for-akpm

might be worth having it in -mm for a bit.




-- 
James Morris
<jmorris@namei.org>