]> git.baikalelectronics.ru Git - kernel.git/commit
audit: don't attempt to lookup PIDs when changing PID filtering audit rules
authorPaul Moore <pmoore@redhat.com>
Fri, 19 Dec 2014 23:35:53 +0000 (18:35 -0500)
committerPaul Moore <pmoore@redhat.com>
Fri, 19 Dec 2014 23:35:53 +0000 (18:35 -0500)
commit18705029ad6f83ee3c1405ab853bd620c1dd2a9c
treede75adc9ca42230ba0f8aeb4255c3f120acb51d8
parent50d0fd63325d17f669b2ba88aa84d9f0977eb2d2
audit: don't attempt to lookup PIDs when changing PID filtering audit rules

Commit cc5fc6c7 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system.  The following commands demonstrate a simple
reproducer.

# auditctl -D
# auditctl -l
# autrace /bin/true
# auditctl -l

This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.

Cc: stable@vger.kernel.org # 3.15
Cc: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
kernel/auditfilter.c