From: Greg Kroah-Hartman Date: Tue, 13 May 2014 23:50:06 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.4.91~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=73cd14e041a30fd6acfd0ad2d9fbe4cc69e504aa;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: audit-convert-ppids-to-the-inital-pid-namespace.patch pid-get-pid_t-ppid-of-task-in-init_pid_ns.patch --- diff --git a/queue-3.14/audit-convert-ppids-to-the-inital-pid-namespace.patch b/queue-3.14/audit-convert-ppids-to-the-inital-pid-namespace.patch new file mode 100644 index 00000000000..8e15519d606 --- /dev/null +++ b/queue-3.14/audit-convert-ppids-to-the-inital-pid-namespace.patch @@ -0,0 +1,53 @@ +From c92cdeb45eea38515e82187f48c2e4f435fb4e25 Mon Sep 17 00:00:00 2001 +From: Richard Guy Briggs +Date: Tue, 10 Dec 2013 22:10:41 -0500 +Subject: audit: convert PPIDs to the inital PID namespace. + +From: Richard Guy Briggs + +commit c92cdeb45eea38515e82187f48c2e4f435fb4e25 upstream. + +sys_getppid() returns the parent pid of the current process in its own pid +namespace. Since audit filters are based in the init pid namespace, a process +could avoid a filter or trigger an unintended one by being in an alternate pid +namespace or log meaningless information. + +Switch to task_ppid_nr() for PPIDs to anchor all audit filters in the +init_pid_ns. + +(informed by ebiederman's 6c621b7e) +Cc: Eric W. Biederman +Signed-off-by: Richard Guy Briggs +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/audit.c | 4 ++-- + kernel/auditsc.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1829,10 +1829,10 @@ void audit_log_task_info(struct audit_bu + spin_unlock_irq(&tsk->sighand->siglock); + + audit_log_format(ab, +- " ppid=%ld pid=%d auid=%u uid=%u gid=%u" ++ " ppid=%d pid=%d auid=%u uid=%u gid=%u" + " euid=%u suid=%u fsuid=%u" + " egid=%u sgid=%u fsgid=%u tty=%s ses=%u", +- sys_getppid(), ++ task_ppid_nr(tsk), + tsk->pid, + from_kuid(&init_user_ns, audit_get_loginuid(tsk)), + from_kuid(&init_user_ns, cred->uid), +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -459,7 +459,7 @@ static int audit_filter_rules(struct tas + case AUDIT_PPID: + if (ctx) { + if (!ctx->ppid) +- ctx->ppid = sys_getppid(); ++ ctx->ppid = task_ppid_nr(tsk); + result = audit_comparator(ctx->ppid, f->op, f->val); + } + break; diff --git a/queue-3.14/pid-get-pid_t-ppid-of-task-in-init_pid_ns.patch b/queue-3.14/pid-get-pid_t-ppid-of-task-in-init_pid_ns.patch new file mode 100644 index 00000000000..3beb9f11ec6 --- /dev/null +++ b/queue-3.14/pid-get-pid_t-ppid-of-task-in-init_pid_ns.patch @@ -0,0 +1,60 @@ +From ad36d28293936b03d6b7996e9d6aadfd73c0eb08 Mon Sep 17 00:00:00 2001 +From: Richard Guy Briggs +Date: Thu, 15 Aug 2013 18:05:12 -0400 +Subject: pid: get pid_t ppid of task in init_pid_ns + +From: Richard Guy Briggs + +commit ad36d28293936b03d6b7996e9d6aadfd73c0eb08 upstream. + +Added the functions task_ppid_nr_ns() and task_ppid_nr() to abstract the lookup +of the PPID (real_parent's pid_t) of a process, including rcu locking, in the +arbitrary and init_pid_ns. +This provides an alternative to sys_getppid(), which is relative to the child +process' pid namespace. + +(informed by ebiederman's 6c621b7e) +Cc: Eric W. Biederman +Signed-off-by: Richard Guy Briggs +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sched.h | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1688,6 +1688,24 @@ static inline pid_t task_tgid_vnr(struct + } + + ++static int pid_alive(const struct task_struct *p); ++static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns) ++{ ++ pid_t pid = 0; ++ ++ rcu_read_lock(); ++ if (pid_alive(tsk)) ++ pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns); ++ rcu_read_unlock(); ++ ++ return pid; ++} ++ ++static inline pid_t task_ppid_nr(const struct task_struct *tsk) ++{ ++ return task_ppid_nr_ns(tsk, &init_pid_ns); ++} ++ + static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, + struct pid_namespace *ns) + { +@@ -1727,7 +1745,7 @@ static inline pid_t task_pgrp_nr(struct + * + * Return: 1 if the process is alive. 0 otherwise. + */ +-static inline int pid_alive(struct task_struct *p) ++static inline int pid_alive(const struct task_struct *p) + { + return p->pids[PIDTYPE_PID].pid != NULL; + } diff --git a/queue-3.14/series b/queue-3.14/series index 1fc08cb0d37..da37f381ece 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -3,3 +3,5 @@ scsi-dual-scan-thread-bug-fix.patch scsi-megaraid-missing-bounds-check-in-mimd_to_kioc.patch kvm-x86-remove-warn_on-from-get_kernel_ns.patch tools-lib-traceevent-fix-memory-leak-in-pretty_print.patch +pid-get-pid_t-ppid-of-task-in-init_pid_ns.patch +audit-convert-ppids-to-the-inital-pid-namespace.patch