leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

audit: allow interfield comparison between gid and ogid

Browse Source 
Allow audit rules to compare the gid of the running task to the gid of the
inode in question.

Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris 2012-01-03 14:23:08 -05:00 committed by Al Viro
parent b34b039324
commit c9fe685f7a
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/linux/audit.h
View File

@ -184,8 +184,9 @@
/* AUDIT_FIELD_COMPARE rule list */ /* AUDIT_FIELD_COMPARE rule list */
#define AUDIT_COMPARE_UID_TO_OBJ_UID 1 #define AUDIT_COMPARE_UID_TO_OBJ_UID 1
#define AUDIT_COMPARE_GID_TO_OBJ_GID 2
#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_UID_TO_OBJ_UID #define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_GID_TO_OBJ_GID
/* Rule fields */ /* Rule fields */
/* These are useful when checking the /* These are useful when checking the
* task structure at task creation time * task structure at task creation time

6
kernel/auditsc.c
View File

@ -474,6 +474,8 @@ static int audit_compare_id(uid_t uid1,
uid_t uid2; uid_t uid2;
int rc; int rc;
BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t));
if (name) { if (name) {
addr = (unsigned long)name; addr = (unsigned long)name;
addr += name_offset; addr += name_offset;
@ -510,6 +512,10 @@ static int audit_field_compare(struct task_struct *tsk,
return audit_compare_id(cred->uid, return audit_compare_id(cred->uid,
name, offsetof(struct audit_names, uid), name, offsetof(struct audit_names, uid),
f, ctx); f, ctx);
case AUDIT_COMPARE_GID_TO_OBJ_GID:
return audit_compare_id(cred->gid,
name, offsetof(struct audit_names, gid),
f, ctx);
default: default:
WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n"); WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n");
return 0; return 0;