<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Oct 23, 2013 at 1:40 PM, William Roberts <span dir="ltr"><<a href="mailto:bill.c.roberts@gmail.com" target="_blank">bill.c.roberts@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">From 0a8623b8f9fa625da81364cf3b87d2799171f83e Mon Sep 17 00:00:00 2001<br><div>From: William Roberts <<a href="mailto:wroberts@tresys.com" target="_blank">wroberts@tresys.com</a>></div>
<div>Date: Tue, 22 Oct 2013 14:23:27 -0700</div>
<div>Subject: [PATCH] audit: Add cmdline to taskinfo output</div><div><br></div><div>On some devices, the cmdline and task info vary. For instance, on</div><div>Android, the cmdline is set to the package name, and the task info</div>
<div>is the name of the VM, which is not very helpful.</div><div><br></div><div>Change-Id: I98a417c9ab3b95664c49aa1c7513cfd8296b6a2a</div><div>Signed-off-by: William Roberts <<a href="mailto:wroberts@tresys.com" target="_blank">wroberts@tresys.com</a>></div>
<div>---</div><div> fs/proc/base.c | 2 +-</div><div> include/linux/proc_fs.h | 1 +</div><div> kernel/auditsc.c | 24 ++++++++++++++++++++++++</div><div> 3 files changed, 26 insertions(+), 1 deletion(-)</div>
<div><br></div><div>diff --git a/fs/proc/base.c b/fs/proc/base.c</div><div>index 2f198da..25b73d3 100644</div><div>--- a/fs/proc/base.c</div><div>+++ b/fs/proc/base.c</div><div>@@ -209,7 +209,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)</div>
<div> <span style="white-space:pre-wrap"> </span>return mm_access(task, PTRACE_MODE_READ);</div><div> }</div><div> </div><div>-static int proc_pid_cmdline(struct task_struct *task, char * buffer)</div><div>+int proc_pid_cmdline(struct task_struct *task, char *buffer)</div>
<div> {</div><div> <span style="white-space:pre-wrap"> </span>int res = 0;</div><div> <span style="white-space:pre-wrap"> </span>unsigned int len;</div><div>diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h</div>
<div>index 85c5073..d85ac14 100644</div><div>--- a/include/linux/proc_fs.h</div><div>+++ b/include/linux/proc_fs.h</div><div>@@ -118,6 +118,7 @@ struct pid_namespace;</div><div> </div><div> extern int pid_ns_prepare_proc(struct pid_namespace *ns);</div>
<div> extern void pid_ns_release_proc(struct pid_namespace *ns);</div><div>+extern int proc_pid_cmdline(struct task_struct *task, char *buffer);</div><div> </div><div> /*</div><div> * proc_tty.c</div><div>diff --git a/kernel/auditsc.c b/kernel/auditsc.c</div>
<div>index 27ad9dd..7f2bf41 100644</div><div>--- a/kernel/auditsc.c</div><div>+++ b/kernel/auditsc.c</div><div>@@ -67,6 +67,7 @@</div><div> #include <linux/syscalls.h></div><div> #include <linux/capability.h></div>
<div> #include <linux/fs_struct.h></div><div>+#include <linux/proc_fs.h></div><div> </div><div> #include "audit.h"</div><div> </div><div>@@ -1158,6 +1159,8 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk</div>
<div> <span style="white-space:pre-wrap"> </span>char name[sizeof(tsk->comm)];</div><div> <span style="white-space:pre-wrap"> </span>struct mm_struct *mm = tsk->mm;</div><div> <span style="white-space:pre-wrap"> </span>struct vm_area_struct *vma;</div>
<div>+<span style="white-space:pre-wrap"> </span>unsigned long page;</div><div>+<span style="white-space:pre-wrap"> </span>int len;</div><div> </div><div> <span style="white-space:pre-wrap"> </span>/* tsk == current */</div>
<div> </div><div>@@ -1179,6 +1182,27 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk</div><div> <span style="white-space:pre-wrap"> </span>}</div><div> <span style="white-space:pre-wrap"> </span>up_read(&mm->mmap_sem);</div>
<div> <span style="white-space:pre-wrap"> </span>}</div><div>+</div><div>+<span style="white-space:pre-wrap"> </span>/* Get the process cmdline */</div><div>+<span style="white-space:pre-wrap"> </span>page = __get_free_page(GFP_TEMPORARY);</div>
<div>+<span style="white-space:pre-wrap"> </span>if (!page)</div><div>+<span style="white-space:pre-wrap"> </span>goto out;</div><div>+</div><div>+<span style="white-space:pre-wrap"> </span>len = proc_pid_cmdline(tsk, (char *)page);</div>
<div>+<span style="white-space:pre-wrap"> </span>if (len <= 0)</div><div>+<span style="white-space:pre-wrap"> </span>goto free;</div><div>+</div><div>+<span style="white-space:pre-wrap"> </span>/*</div><div>
+<span style="white-space:pre-wrap"> </span> * Ensure NULL terminated! Application could</div><div>+<span style="white-space:pre-wrap"> </span> * could be using setproctitle(3).</div><div>+<span style="white-space:pre-wrap"> </span> */</div>
<div>+<span style="white-space:pre-wrap"> </span>((char *)page)[len-1] = '\0';</div><div>+</div><div>+<span style="white-space:pre-wrap"> </span>audit_log_format(ab, " cmdline=");</div><div>+<span style="white-space:pre-wrap"> </span>audit_log_untrustedstring(ab, (char *)page);</div>
<div>+free:</div><div>+<span style="white-space:pre-wrap"> </span>free_page(page);</div><div>+out:</div><div> <span style="white-space:pre-wrap"> </span>audit_log_task_context(ab);</div><div> }</div><span><font color="#888888"><div>
</div><div>
-- </div><div>1.7.9.5</div><div><br></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div>A few notes on this moving forward:</div><div>1. I forgot to put in the subject kernel v3.4.0, this only applies to that</div><div>2. Yes I know gmail mangled the path (i'm working on some smtp issues right now)</div>
<div>3. The main purpose of this is to figure out upstream acceptance, Richard Briggs has chimed in, and has no major objections</div><div>4. This could be a dynamic on/off setting, which brings me to my question, of: "What is the status of E.Paris's generic feature set/get" patches fare? This is a great use case for those.</div>
<br><br>
</div></div>