Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1589968
| From | Richard Guy Briggs <rgb@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH ALT2] audit: don't create PATH records for anonymous parents and their children |
| Date | 2017-03-01 04:30 +0100 |
| Message-ID | <tg37I-5hT-5@gated-at.bofh.it> (permalink) |
| References | <tg37I-5hT-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Tracefs or debugfs were causing hundreds to thousands of null PATH records to
be associated with the init_module and finit_module SYSCALL records on a few
modules when the following rule was in place for startup:
-a always,exit -F arch=x86_64 -S init_module -F key=mod-load
Don't create those records when the parent is not found in
that task context's audit names_list.
See https://github.com/linux-audit/audit-kernel/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
kernel/auditsc.c | 20 +++++++-------------
1 files changed, 7 insertions(+), 13 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4db32e8..83eb3bc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1889,6 +1889,10 @@ void __audit_inode_child(struct inode *parent,
}
}
+ if (!found_parent)
+ /* Don't track if parent is "anonymous" */
+ return;
+
/* is there a matching child entry? */
list_for_each_entry(n, &context->names_list, list) {
/* can only match entries that have a name */
@@ -1908,14 +1912,6 @@ void __audit_inode_child(struct inode *parent,
}
}
- if (!found_parent) {
- /* create a new, "anonymous" parent record */
- n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
- if (!n)
- return;
- audit_copy_inode(n, NULL, parent);
- }
-
if (!found_child) {
found_child = audit_alloc_name(context, type);
if (!found_child)
@@ -1924,11 +1920,9 @@ void __audit_inode_child(struct inode *parent,
/* Re-use the name belonging to the slot for a matching parent
* directory. All names for this context are relinquished in
* audit_free_names() */
- if (found_parent) {
- found_child->name = found_parent->name;
- found_child->name_len = AUDIT_NAME_FULL;
- found_child->name->refcnt++;
- }
+ found_child->name = found_parent->name;
+ found_child->name_len = AUDIT_NAME_FULL;
+ found_child->name->refcnt++;
}
if (inode)
--
1.7.1
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:30 +0100
[PATCH ALT2] audit: don't create PATH records for anonymous parents and their children Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:50 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-01 05:20 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-03 22:30 +0100
[PATCH ALT5] audit: ignore module syscalls on inode child Richard Guy Briggs <rgb@redhat.com> - 2017-03-03 23:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Paul Moore <paul@paul-moore.com> - 2017-03-04 01:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Jessica Yu <jeyu@redhat.com> - 2017-03-06 23:40 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 04:50 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 03:10 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Paul Moore <paul@paul-moore.com> - 2017-03-04 01:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 05:00 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:00 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 18:50 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 19:40 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 20:20 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 23:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 21:50 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 17:30 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:40 +0100
Re: Hundreds of null PATH records for *init_module syscall audit logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 16:40 +0100
[PATCH ALT4] audit: show fstype:pathname for entries with anonymous parents Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 08:50 +0100
Re: [PATCH ALT4] audit: show fstype:pathname for entries with anonymous parents kbuild test robot <lkp@intel.com> - 2017-03-02 14:10 +0100
csiph-web