linux-kernel - [PATCH 0/3] audit: remove audit_log_start() contention in AUDIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  4 Dec 2013 21:45:53 -0500
From:	Richard Guy Briggs <rgb@...hat.com>
To:	linux-audit@...hat.com, linux-kernel@...r.kernel.org
Cc:	Richard Guy Briggs <rgb@...hat.com>,
	Eric Paris <eparis@...hat.com>,
	Gao feng <gaofeng@...fujitsu.com>,
	Toshiyuki Okajima <toshi.okajima@...fujitsu.com>
Subject: [PATCH 0/3] audit: remove audit_log_start() contention in AUDIT_USER type calls

There is a race condition between systemd and auditd:

systemd                                    |auditd
-------------------------------------------+-----------------------------------
...                                        |
-> audit_receive                           |...
   -> mutex_lock(&audit_cmd_mutex)         |-> audit_receive
      ... -> audit_log_start               |   -> mutex_lock(&audit_cmd_mutex)
             -> wait_for_auditd            |      // wait for systemd
                -> schedule_timeout(60*HZ) |

This fix will take care of systemd and anything USING audit.  It still means
that we could race with something configuring audit and auditd shutting down.

The idea of dropping the lock at the top of audit_receive_msg() isn't as clean
as I had hoped, with AUDIT_ADD_RULE, AUDIT_TRIM, AUDIT_MAKE_EQUIV all
potentially allocating additional audit buffers indirectly through
trim_marked().  It may make sense to have trim_marked() send its queue through
a new thread.

Richard Guy Briggs (3):
  selinux: call WARN_ONCE() instead of calling audit_log_start()
  smack: call WARN_ONCE() instead of calling audit_log_start()
  audit: drop audit_cmd_lock in AUDIT_USER family of cases

 kernel/audit.c                 |    2 ++
 security/selinux/ss/services.c |   12 ++++--------
 security/smack/smack_lsm.c     |    5 ++---
 3 files changed, 8 insertions(+), 11 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/