forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

audit: audit feature to set loginuid immutable

Browse source 
This adds a new 'audit_feature' bit which allows userspace to set it
such that the loginuid is absolutely immutable, even if you have
CAP_AUDIT_CONTROL.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris 2013-05-23 14:26:00 -04:00
commit 21b85c31d2
3 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/uapi/linux/audit.h
View file

@ -387,7 +387,8 @@ struct audit_features {
}; };
#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0 #define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0
#define AUDIT_LAST_FEATURE AUDIT_FEATURE_ONLY_UNSET_LOGINUID #define AUDIT_FEATURE_LOGINUID_IMMUTABLE 1
#define AUDIT_LAST_FEATURE AUDIT_FEATURE_LOGINUID_IMMUTABLE
#define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) #define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE)
#define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ #define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */

3
kernel/audit.c
View file

@ -144,8 +144,9 @@ static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
.features = 0, .features = 0,
.lock = 0,}; .lock = 0,};
static char *audit_feature_names[1] = { static char *audit_feature_names[2] = {
"only_unset_loginuid", "only_unset_loginuid",
"loginuid_immutable",
}; };

3
kernel/auditsc.c
View file

@ -1971,6 +1971,9 @@ static int audit_set_loginuid_perm(kuid_t loginuid)
/* if we are unset, we don't need privs */ /* if we are unset, we don't need privs */
if (!audit_loginuid_set(current)) if (!audit_loginuid_set(current))
return 0; return 0;
/* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
return -EPERM;
/* it is set, you need permission */ /* it is set, you need permission */
if (!capable(CAP_AUDIT_CONTROL)) if (!capable(CAP_AUDIT_CONTROL))
return -EPERM; return -EPERM;