Merge tag 'audit-pr-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoor...

Pull audit updates from Paul Moore:
 "Another small pull request for audit, most of the patches are
  documentation updates with only two real code changes: one to fix a
  compiler warning for a dummy function/macro, and one to cleanup some
  code since we removed the AUDIT_FILTER_ENTRY ages ago (v4.17)"

* tag 'audit-pr-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: drop /proc/PID/loginuid documentation Format field
  audit: avoid -Wempty-body warning
  audit: document /proc/PID/sessionid
  audit: document /proc/PID/loginuid
  MAINTAINERS: update audit files
  audit: further cleanup of AUDIT_FILTER_ENTRY deprecation

diff --git a/Documentation/ABI/stable/procfs-audit_loginuid b/Documentation/ABI/stable/procfs-audit_loginuid
new file mode 100644 (file)
index 0000000..cda4051
--- /dev/null
+++ b/Documentation/ABI/stable/procfs-audit_loginuid
@@ -0,0 +1,27 @@
+What:          Audit Login UID
+Date:          2005-02-01
+KernelVersion: 2.6.11-rc2 1e2d1492e178 ("[PATCH] audit: handle loginuid through proc")
+Contact:       linux-audit@redhat.com
+Users:         audit and login applications
+Description:
+               The /proc/$pid/loginuid pseudofile is written to set and
+               read to get the audit login UID of process $pid as a
+               decimal unsigned int (%u, u32).  If it is unset,
+               permissions are not needed to set it.  The accessor must
+               have CAP_AUDIT_CONTROL in the initial user namespace to
+               write it if it has been set.  It cannot be written again
+               if AUDIT_FEATURE_LOGINUID_IMMUTABLE is enabled.  It
+               cannot be unset if AUDIT_FEATURE_ONLY_UNSET_LOGINUID is
+               enabled.
+
+What:          Audit Login Session ID
+Date:          2008-03-13
+KernelVersion: 2.6.25-rc7 1e0bd7550ea9 ("[PATCH] export sessionid alongside the loginuid in procfs")
+Contact:       linux-audit@redhat.com
+Users:         audit and login applications
+Description:
+               The /proc/$pid/sessionid pseudofile is read to get the
+               audit login session ID of process $pid as a decimal
+               unsigned int (%u, u32).  It is set automatically,
+               serially assigned with each new login.
+

diff --git a/MAINTAINERS b/MAINTAINERS
index 83c2b18..411f98d 100644 (file)
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3018,9 +3018,11 @@ L:       linux-audit@redhat.com (moderated for non-subscribers)
 S:     Supported
 W:     https://github.com/linux-audit
 T:     git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
+F:     include/asm-generic/audit_*.h
 F:     include/linux/audit.h
 F:     include/uapi/linux/audit.h
 F:     kernel/audit*
+F:     lib/*audit.c
 
 AUXILIARY DISPLAY DRIVERS
 M:     Miguel Ojeda <ojeda@kernel.org>

diff --git a/kernel/audit.h b/kernel/audit.h
index 3b9c094..1522e10 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -292,8 +292,8 @@ extern void audit_filter_inodes(struct task_struct *tsk,
 extern struct list_head *audit_killed_trees(void);
 #else /* CONFIG_AUDITSYSCALL */
 #define auditsc_get_stamp(c, t, s) 0
-#define audit_put_watch(w) {}
-#define audit_get_watch(w) {}
+#define audit_put_watch(w) do { } while (0)
+#define audit_get_watch(w) do { } while (0)
 #define audit_to_watch(k, p, l, o) (-EINVAL)
 #define audit_add_watch(k, l) (-EINVAL)
 #define audit_remove_watch_rule(k) BUG()
@@ -302,8 +302,8 @@ extern struct list_head *audit_killed_trees(void);
 
 #define audit_alloc_mark(k, p, l) (ERR_PTR(-EINVAL))
 #define audit_mark_path(m) ""
-#define audit_remove_mark(m)
-#define audit_remove_mark_rule(k)
+#define audit_remove_mark(m) do { } while (0)
+#define audit_remove_mark_rule(k) do { } while (0)
 #define audit_mark_compare(m, i, d) 0
 #define audit_exe_compare(t, m) (-EINVAL)
 #define audit_dupe_exe(n, o) (-EINVAL)
@@ -311,8 +311,8 @@ extern struct list_head *audit_killed_trees(void);
 #define audit_remove_tree_rule(rule) BUG()
 #define audit_add_tree_rule(rule) -EINVAL
 #define audit_make_tree(rule, str, op) -EINVAL
-#define audit_trim_trees() (void)0
-#define audit_put_tree(tree) (void)0
+#define audit_trim_trees() do { } while (0)
+#define audit_put_tree(tree) do { } while (0)
 #define audit_tag_tree(old, new) -EINVAL
 #define audit_tree_path(rule) ""       /* never called */
 #define audit_kill_trees(context) BUG()

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9973865..175ef6f 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -805,8 +805,7 @@ static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
  * (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
  */
 static void audit_filter_syscall(struct task_struct *tsk,
-                                            struct audit_context *ctx,
-                                            struct list_head *list)
+                                struct audit_context *ctx)
 {
        struct audit_entry *e;
        enum audit_state state;
@@ -815,7 +814,7 @@ static void audit_filter_syscall(struct task_struct *tsk,
                return;
 
        rcu_read_lock();
-       list_for_each_entry_rcu(e, list, list) {
+       list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
                if (audit_in_mask(&e->rule, ctx->major) &&
                    audit_filter_rules(tsk, &e->rule, ctx, NULL,
                                       &state, false)) {
@@ -1627,8 +1626,7 @@ void __audit_free(struct task_struct *tsk)
                context->return_valid = AUDITSC_INVALID;
                context->return_code = 0;
 
-               audit_filter_syscall(tsk, context,
-                                    &audit_filter_list[AUDIT_FILTER_EXIT]);
+               audit_filter_syscall(tsk, context);
                audit_filter_inodes(tsk, context);
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();
@@ -1735,8 +1733,7 @@ void __audit_syscall_exit(int success, long return_code)
                else
                        context->return_code  = return_code;
 
-               audit_filter_syscall(current, context,
-                                    &audit_filter_list[AUDIT_FILTER_EXIT]);
+               audit_filter_syscall(current, context);
                audit_filter_inodes(current, context);
                if (context->current_state == AUDIT_RECORD_CONTEXT)
                        audit_log_exit();