diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2013-10-30 23:05:24 +0100 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-11-05 17:15:03 +0100 |
| commit | 9410d228a4cf434305306746bb799fb7acdd8648 (patch) | |
| tree | 93dc6f756af3c2557f2e1377bad52582fdd9fe19 /fs | |
| parent | audit: move audit_aux_data_execve contents into audit_context union (diff) | |
| download | linux-9410d228a4cf434305306746bb799fb7acdd8648.tar.xz linux-9410d228a4cf434305306746bb799fb7acdd8648.zip | |
audit: call audit_bprm() only once to add AUDIT_EXECVE information
Move the audit_bprm() call from search_binary_handler() to exec_binprm(). This
allows us to get rid of the mm member of struct audit_aux_data_execve since
bprm->mm will equal current->mm.
This also mitigates the issue that ->argc could be modified by the
load_binary() call in search_binary_handler().
audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
context every time search_binary_handler() was recursively called. Only one
reference is necessary.
Reported-by: Oleg Nesterov <onestero@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
This patch is against 3.11, but was developed on Oleg's post-3.11 patches that
introduce exec_binprm().
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/exec.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/exec.c b/fs/exec.c index fd774c7cb483..c5c24f2fc44a 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1383,10 +1383,6 @@ int search_binary_handler(struct linux_binprm *bprm) if (retval) return retval; - retval = audit_bprm(bprm); - if (retval) - return retval; - /* Need to fetch pid before load_binary changes it */ old_pid = current->pid; rcu_read_lock(); @@ -1408,6 +1404,7 @@ int search_binary_handler(struct linux_binprm *bprm) bprm->recursion_depth = depth; if (retval >= 0) { if (depth == 0) { + audit_bprm(bprm); trace_sched_process_exec(current, old_pid, bprm); ptrace_event(PTRACE_EVENT_EXEC, old_vpid); } |