releases/4.14.7/audit-allow-auditd-to-set-pid-to-0-to-end-auditing.patch

   1 From foo@baz Tue Dec 12 10:32:42 CET 2017
   2 From: Steve Grubb <sgrubb@redhat.com>
   3 Date: Tue, 17 Oct 2017 18:29:22 -0400
   4 Subject: audit: Allow auditd to set pid to 0 to end auditing
   5
   6 From: Steve Grubb <sgrubb@redhat.com>
   7
   8
   9 [ Upstream commit 33e8a907804428109ce1d12301c3365d619cc4df ]
  10
  11 The API to end auditing has historically been for auditd to set the
  12 pid to 0. This patch restores that functionality.
  13
  14 See: https://github.com/linux-audit/audit-kernel/issues/69
  15
  16 Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
  17 Signed-off-by: Steve Grubb <sgrubb@redhat.com>
  18 Signed-off-by: Paul Moore <paul@paul-moore.com>
  19 Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  kernel/audit.c |   29 ++++++++++++++++-------------
  23  1 file changed, 16 insertions(+), 13 deletions(-)
  24
  25 --- a/kernel/audit.c
  26 +++ b/kernel/audit.c
  27 @@ -1197,25 +1197,28 @@ static int audit_receive_msg(struct sk_b
  28                         pid_t auditd_pid;
  29                         struct pid *req_pid = task_tgid(current);
  30
  31 -                       /* sanity check - PID values must match */
  32 -                       if (new_pid != pid_vnr(req_pid))
  33 +                       /* Sanity check - PID values must match. Setting
  34 +                        * pid to 0 is how auditd ends auditing. */
  35 +                       if (new_pid && (new_pid != pid_vnr(req_pid)))
  36                                 return -EINVAL;
  37
  38                         /* test the auditd connection */
  39                         audit_replace(req_pid);
  40
  41                         auditd_pid = auditd_pid_vnr();
  42 -                       /* only the current auditd can unregister itself */
  43 -                       if ((!new_pid) && (new_pid != auditd_pid)) {
  44 -                               audit_log_config_change("audit_pid", new_pid,
  45 -                                                       auditd_pid, 0);
  46 -                               return -EACCES;
  47 -                       }
  48 -                       /* replacing a healthy auditd is not allowed */
  49 -                       if (auditd_pid && new_pid) {
  50 -                               audit_log_config_change("audit_pid", new_pid,
  51 -                                                       auditd_pid, 0);
  52 -                               return -EEXIST;
  53 +                       if (auditd_pid) {
  54 +                               /* replacing a healthy auditd is not allowed */
  55 +                               if (new_pid) {
  56 +                                       audit_log_config_change("audit_pid",
  57 +                                                       new_pid, auditd_pid, 0);
  58 +                                       return -EEXIST;
  59 +                               }
  60 +                               /* only current auditd can unregister itself */
  61 +                               if (pid_vnr(req_pid) != auditd_pid) {
  62 +                                       audit_log_config_change("audit_pid",
  63 +                                                       new_pid, auditd_pid, 0);
  64 +                                       return -EACCES;
  65 +                               }
  66                         }
  67
  68                         if (new_pid) {