linux.git/kernel/auditsc.c, branch v2.6.22-rc4

[PATCH] Abnormal End of Processes

2007-05-11T09:38:26+00:00

Hi,

I have been working on some code that detects abnormal events based on audit
system events. One kind of event that we currently have no visibility for is
when a program terminates due to segfault - which should never happen on a
production machine. And if it did, you'd want to investigate it. Attached is a
patch that collects these events and sends them into the audit system.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] match audit name data

2007-05-11T09:38:26+00:00

Make more effort to detect previously collected names, so we don't log
multiple PATH records for a single filesystem object. Add
audit_inc_name_count() to reduce duplicate code.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] complete message queue auditing

2007-05-11T09:38:26+00:00

Handle the edge cases for POSIX message queue auditing. Collect inode
info when opening an existing mq, and for send/receive operations. Remove
audit_inode_update() as it has really evolved into the equivalent of
audit_inode().

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] initialize name osid

2007-05-11T09:38:25+00:00

Audit contexts can be reused, so initialize a name's osid to the
default in audit_getname(). This ensures we don't log a bogus object
label when no inode data is collected for a name.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] audit signal recipients

2007-05-11T09:38:25+00:00

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] auditing ptrace

2007-05-11T09:38:25+00:00

Signed-off-by: Al Viro

[PATCH] fix deadlock in audit_log_task_context()

2007-03-14T22:27:48+00:00

GFP_KERNEL allocations in non-blocking context; fixed by killing
an idiotic use of security_getprocattr().

Acked-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

[PATCH] AUDIT_FD_PAIR

2007-02-18T02:30:15+00:00

Provide an audit record of the descriptor pair returned by pipe() and
socketpair().  Rewritten from the original posted to linux-audit by
John D. Ramsdell 

Signed-off-by: Al Viro

[PATCH] struct path: convert kernel

2006-12-08T16:28:46+00:00

Signed-off-by: Josef Sipek 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] tty: ->signal->tty locking

2006-12-08T16:28:38+00:00

Fix the locking of signal->tty.

Use ->sighand->siglock to protect ->signal->tty; this lock is already used
by most other members of ->signal/->sighand.  And unless we are 'current'
or the tasklist_lock is held we need ->siglock to access ->signal anyway.

(NOTE: sys_unshare() is broken wrt ->sighand locking rules)

Note that tty_mutex is held over tty destruction, so while holding
tty_mutex any tty pointer remains valid.  Otherwise the lifetime of ttys
are governed by their open file handles.  This leaves some holes for tty
access from signal->tty (or any other non file related tty access).

It solves the tty SLAB scribbles we were seeing.

(NOTE: the change from group_send_sig_info to __group_send_sig_info needs to
       be examined by someone familiar with the security framework, I think
       it is safe given the SEND_SIG_PRIV from other __group_send_sig_info
       invocations)

[schwidefsky@de.ibm.com: 3270 fix]
[akpm@osdl.org: various post-viro fixes]
Signed-off-by: Peter Zijlstra 
Acked-by: Alan Cox 
Cc: Oleg Nesterov 
Cc: Prarit Bhargava 
Cc: Chris Wright 
Cc: Roland McGrath 
Cc: Stephen Smalley 
Cc: James Morris 
Cc: "David S. Miller" 
Cc: Jeff Dike 
Cc: Martin Schwidefsky 
Cc: Jan Kara 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds