Kernel audit_context and name_count problem

[Andy Fanton]

Hi -

I'm working on an LKM for a security software product that does real-time
file system change monitoring.  The product has been in the field for a
number of years and in use by many customers with great success.

Recently we ran into an installation that is making use of Audit in addition
to some Symantec products along with our product.  This "stack" of security
and detection software all running simultaneously is causing an issue that
they're blaming on our driver.

After lots of digging, the real issue is that the audit_context->name_count
is growing during certain syscall paths (sys_rename in particular), and at
some point a getname() (which ends up in audit_getname() ) is called that
hits the following line in auditsc.c:

BUG_ON(context->name_count >= AUDIT_NAMES);

This is on RHEL 5.8 with a 2.6.18-330el5 kernel, but looking at kernel
sources shows this same code exists in most of the 2.6 kernel lines.

The question is this:  Is there any sane way for my code to check that
name_count value in current->audit_context BEFORE calling getname() so I can
avoid the BUG_ON and subsequent mayhem that ensues?  I'd rather fail
gracefully than crash their system every time too many people call
getname().

Unfortunately the structure definition for audit_context is inside the C
file, which makes it opaque to my LKM code.  That structure changes enough
between kernel versions that it would be difficult (and stupid anyway) to
put a manual "copy" of the structure definition in my own code so that I
could access that value.

My own code only uses a maximum of 4 of the available AUDIT_NAMES (20) slots
in the audit_context structure.  It's the presence of other 3rd party LKMs
and their use of Audit that is causing this condition, and the reason it is
somewhat beyond my control.

Any suggestions or hints would be greatly appreciated!  Thanks to all!

- Andy