Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1422337

[PATCH] audit: catch errors from audit_filter_rules field checks

Show all headers | View raw

In the case of an error returned from a field check in an audit filter
syscall rule, it is treated as a match and the rule action is honoured.

This could cause a rule with a default of NEVER and an selinux field
check error to avoid logging.

Recommend matching with an action of ALWAYS to catch malicious abuse of
this bug.  The downside of this approach is it could DoS the audit
subsystem.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 kernel/auditsc.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 71e14d8..6123672 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -683,6 +683,10 @@ static int audit_filter_rules(struct task_struct *tsk,
 		}
 		if (!result)
 			return 0;
+		if (result < 0) {
+			*state = AUDIT_RECORD_CONTEXT;
+			return 1;
+		}
 	}
 
 	if (ctx) {
-- 
1.7.1

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] audit: catch errors from audit_filter_rules field checks Richard Guy Briggs <rgb@redhat.com> - 2016-06-14 23:10 +0200
  Re: [PATCH] audit: catch errors from audit_filter_rules field checks Paul Moore <paul@paul-moore.com> - 2016-06-16 23:10 +0200

csiph-web