[PATCH] audit: Send replies in the proper network namespace.
Richard Guy Briggs
rgb at redhat.com
Sun Mar 16 19:13:05 UTC 2014
On 14/03/16, Richard Guy Briggs wrote:
> On 14/02/28, Eric W. Biederman wrote:
> >
> > In perverse cases of file descriptor passing the current network
> > namespace of a process and the network namespace of a socket used by
> > that socket may differ. Therefore use the network namespace of the
> > appropiate socket to ensure replies always go to the appropiate
> > socket.
> >
> > Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
>
> Signed-off-by: Richard Guy Briggs <rgb at tricolour.ca>
Again, sorry for the noise, please change sig to:
Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> > ---
> >
> > This is an incremental change on top of my previous patch to guarantee
> > that replies always happen in the appropriate network namespace.
> >
> > include/linux/audit.h | 3 ++-
> > kernel/audit.c | 21 ++++++++++-----------
> > kernel/auditfilter.c | 7 +++++--
> > 3 files changed, 17 insertions(+), 14 deletions(-)
> >
> > diff --git a/include/linux/audit.h b/include/linux/audit.h
> > index aa865a9a4c4f..ec1464df4c60 100644
> > --- a/include/linux/audit.h
> > +++ b/include/linux/audit.h
> > @@ -43,6 +43,7 @@ struct mq_attr;
> > struct mqstat;
> > struct audit_watch;
> > struct audit_tree;
> > +struct sk_buff;
> >
> > struct audit_krule {
> > int vers_ops;
> > @@ -463,7 +464,7 @@ extern int audit_filter_user(int type);
> > extern int audit_filter_type(int type);
> > extern int audit_rule_change(int type, __u32 portid, int seq,
> > void *data, size_t datasz);
> > -extern int audit_list_rules_send(__u32 portid, int seq);
> > +extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
> >
> > extern u32 audit_enabled;
> > #else /* CONFIG_AUDIT */
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index 1e5756f16f6f..32086bff5564 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -570,9 +570,11 @@ static int audit_send_reply_thread(void *arg)
> > * Allocates an skb, builds the netlink message, and sends it to the port id.
> > * No failure notifications.
> > */
> > -static void audit_send_reply(__u32 portid, int seq, int type, int done,
> > +static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
> > int multi, const void *payload, int size)
> > {
> > + u32 portid = NETLINK_CB(request_skb).portid;
> > + struct net *net = sock_net(NETLINK_CB(request_skb).sk);
> > struct sk_buff *skb;
> > struct task_struct *tsk;
> > struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
> > @@ -585,7 +587,7 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
> > if (!skb)
> > goto out;
> >
> > - reply->net = get_net(current->nsproxy->net_ns);
> > + reply->net = get_net(net);
> > reply->portid = portid;
> > reply->skb = skb;
> >
> > @@ -675,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb)
> >
> > seq = nlmsg_hdr(skb)->nlmsg_seq;
> >
> > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
> > - &af, sizeof(af));
> > + audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
> >
> > return 0;
> > }
> > @@ -796,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> > s.backlog = skb_queue_len(&audit_skb_queue);
> > s.version = AUDIT_VERSION_LATEST;
> > s.backlog_wait_time = audit_backlog_wait_time;
> > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
> > - &s, sizeof(s));
> > + audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
> > break;
> > }
> > case AUDIT_SET: {
> > @@ -907,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> > seq, data, nlmsg_len(nlh));
> > break;
> > case AUDIT_LIST_RULES:
> > - err = audit_list_rules_send(NETLINK_CB(skb).portid, seq);
> > + err = audit_list_rules_send(skb, seq);
> > break;
> > case AUDIT_TRIM:
> > audit_trim_trees();
> > @@ -972,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> > memcpy(sig_data->ctx, ctx, len);
> > security_release_secctx(ctx, len);
> > }
> > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
> > - 0, 0, sig_data, sizeof(*sig_data) + len);
> > + audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
> > + sig_data, sizeof(*sig_data) + len);
> > kfree(sig_data);
> > break;
> > case AUDIT_TTY_GET: {
> > @@ -985,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> > s.log_passwd = tsk->signal->audit_tty_log_passwd;
> > spin_unlock(&tsk->sighand->siglock);
> >
> > - audit_send_reply(NETLINK_CB(skb).portid, seq,
> > - AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
> > + audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
> > break;
> > }
> > case AUDIT_TTY_SET: {
> > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> > index a5e3d73d73e4..e8d1c7c515d7 100644
> > --- a/kernel/auditfilter.c
> > +++ b/kernel/auditfilter.c
> > @@ -30,6 +30,7 @@
> > #include <linux/slab.h>
> > #include <linux/security.h>
> > #include <net/net_namespace.h>
> > +#include <net/sock.h>
> > #include "audit.h"
> >
> > /*
> > @@ -1069,8 +1070,10 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data,
> > * @portid: target portid for netlink audit messages
> > * @seq: netlink audit message sequence (serial) number
> > */
> > -int audit_list_rules_send(__u32 portid, int seq)
> > +int audit_list_rules_send(struct sk_buff *request_skb, int seq)
> > {
> > + u32 portid = NETLINK_CB(request_skb).portid;
> > + struct net *net = sock_net(NETLINK_CB(request_skb).sk);
> > struct task_struct *tsk;
> > struct audit_netlink_list *dest;
> > int err = 0;
> > @@ -1084,7 +1087,7 @@ int audit_list_rules_send(__u32 portid, int seq)
> > dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
> > if (!dest)
> > return -ENOMEM;
> > - dest->net = get_net(current->nsproxy->net_ns);
> > + dest->net = get_net(net);
> > dest->portid = portid;
> > skb_queue_head_init(&dest->q);
> >
> > --
> > 1.7.5.4
> >
>
> - RGB
>
> --
> Richard Guy Briggs <rbriggs at redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
- RGB
--
Richard Guy Briggs <rbriggs at redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
More information about the Linux-audit
mailing list