diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2008-11-13 00:37:41 +0100 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2008-12-09 08:27:38 +0100 |
| commit | a64e64944f4b8ce3288519555dbaa0232414b8ac (patch) | |
| tree | 6b37f5444c49379580b6b4fead84a75ca474d0ab | |
| parent | [PATCH] Audit: make audit=0 actually turn off audit (diff) | |
| download | linux-a64e64944f4b8ce3288519555dbaa0232414b8ac.tar.xz linux-a64e64944f4b8ce3288519555dbaa0232414b8ac.zip | |
[PATCH] return records for fork() both to child and parent
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | include/linux/audit.h | 2 | ||||
| -rw-r--r-- | kernel/auditsc.c | 17 | ||||
| -rw-r--r-- | kernel/fork.c | 1 |
3 files changed, 20 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index 6272a395d43c..1b2a6a5c1876 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -391,6 +391,7 @@ extern int audit_classify_arch(int arch); #ifdef CONFIG_AUDITSYSCALL /* These are defined in auditsc.c */ /* Public API */ +extern void audit_finish_fork(struct task_struct *child); extern int audit_alloc(struct task_struct *task); extern void audit_free(struct task_struct *task); extern void audit_syscall_entry(int arch, @@ -504,6 +505,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) extern int audit_n_rules; extern int audit_signals; #else +#define audit_finish_fork(t) #define audit_alloc(t) ({ 0; }) #define audit_free(t) do { ; } while (0) #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index cf5bc2f5f9c3..de8468050afa 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1548,6 +1548,23 @@ void audit_syscall_entry(int arch, int major, context->ppid = 0; } +void audit_finish_fork(struct task_struct *child) +{ + struct audit_context *ctx = current->audit_context; + struct audit_context *p = child->audit_context; + if (!p || !ctx || !ctx->auditable) + return; + p->arch = ctx->arch; + p->major = ctx->major; + memcpy(p->argv, ctx->argv, sizeof(ctx->argv)); + p->ctime = ctx->ctime; + p->dummy = ctx->dummy; + p->auditable = ctx->auditable; + p->in_syscall = ctx->in_syscall; + p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL); + p->ppid = current->pid; +} + /** * audit_syscall_exit - deallocate audit context after a system call * @tsk: task being audited diff --git a/kernel/fork.c b/kernel/fork.c index 2a372a0e206f..8d6a7dd9282b 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1398,6 +1398,7 @@ long do_fork(unsigned long clone_flags, init_completion(&vfork); } + audit_finish_fork(p); tracehook_report_clone(trace, regs, clone_flags, nr, p); /* |