linux-kernel - Fwd: [patch for 2.6.27? 1/1] audit: ignore terminating NUL in AUDIT_USER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1887464454.1703501237470767793.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com>
Date:	Thu, 19 Mar 2009 09:52:47 -0400 (EDT)
From:	Miloslav Trmac <mitr@...hat.com>
To:	viro <viro@...iv.linux.org.uk>
Cc:	Steve Grubb <sgrubb@...hat.com>, Eric Paris <eparis@...hat.com>,
	akpm <akpm@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Fwd: [patch for 2.6.27? 1/1] audit: ignore terminating NUL in
 AUDIT_USER_TTY messages

Hello,
this appears to have been lost somewhere...
    Mirek
Return-Path: akpm@...ux-foundation.org
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.5.31) by
 mail02.corp.redhat.com with LMTP; Mon, 22 Sep 2008 17:06:23 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 03ECB904B0;
	Mon, 22 Sep 2008 17:06:23 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta01.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id BOWPPQbjMo3H; Mon, 22 Sep 2008 17:06:22 -0400 (EDT)
Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id D9FBA90496;
	Mon, 22 Sep 2008 17:06:22 -0400 (EDT)
Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32])
	by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m8ML6KJ3001850;
	Mon, 22 Sep 2008 17:06:21 -0400
Received: from smtp1.linux-foundation.org (smtp1.linux-foundation.org [140.211.169.13])
	by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m8ML64v6001443;
	Mon, 22 Sep 2008 17:06:05 -0400
Received: from imap1.linux-foundation.org (imap1.linux-foundation.org [140.211.169.55])
	by smtp1.linux-foundation.org (8.14.2/8.13.5/Debian-3ubuntu1.1) with ESMTP id m8ML5XaL014107
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Mon, 22 Sep 2008 14:05:34 -0700
Received: from localhost.localdomain (localhost [127.0.0.1])
	by imap1.linux-foundation.org (8.13.5.20060308/8.13.5/Debian-3ubuntu1.1) with ESMTP id m8ML5XGb029625;
	Mon, 22 Sep 2008 14:05:33 -0700
Message-Id: <200809222105.m8ML5XGb029625@...p1.linux-foundation.org>
Subject: [patch for 2.6.27? 1/1] audit: ignore terminating NUL in AUDIT_USER_TTY messages
To: viro@...iv.linux.org.uk
Cc: akpm@...ux-foundation.org, mitr@...hat.com, eparis@...hat.com,
        sgrubb@...hat.com
From: akpm@...ux-foundation.org
Date: Mon, 22 Sep 2008 14:05:33 -0700
X-Spam-Status: No, hits=-3.358 required=5 tests=AWL,BAYES_00,OSDL_HEADER_SUBJECT_BRACKETED
X-Spam-Checker-Version: SpamAssassin 3.2.4-osdl_revision__1.47__
X-MIMEDefang-Filter: lf$Revision: 1.188 $
X-Scanned-By: MIMEDefang 2.58 on 172.16.27.26
X-Scanned-By: MIMEDefang 2.63 on 172.16.48.32
X-Scanned-By: MIMEDefang 2.63 on 140.211.169.13
X-RedHat-Spam-Score: -1.588 

From: Miloslav Trmac <mitr@...hat.com>

AUDIT_USER_TTY, like all other messages sent from user-space, is sent
NUL-terminated.  Unlike other user-space audit messages, which come only
from trusted sources, AUDIT_USER_TTY messages are processed using
audit_log_n_untrustedstring().

This patch modifies AUDIT_USER_TTY handling to ignore the trailing NUL
and use the "quoted_string" representation of the message if possible.

Signed-off-by: Miloslav Trmac <mitr@...hat.com>
Cc: Eric Paris <eparis@...hat.com>
Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: Steve Grubb <sgrubb@...hat.com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 kernel/audit.c |    3 +++
 1 file changed, 3 insertions(+)

diff -puN kernel/audit.c~audit-ignore-terminating-nul-in-audit_user_tty-messages kernel/audit.c
--- a/kernel/audit.c~audit-ignore-terminating-nul-in-audit_user_tty-messages
+++ a/kernel/audit.c
@@ -763,6 +763,9 @@ static int audit_receive_msg(struct sk_b
 
 				audit_log_format(ab, " msg=");
 				size = nlmsg_len(nlh);
+				if (size > 0 &&
+				    ((unsigned char *)data)[size - 1] == '\0')
+					size--;
 				audit_log_n_untrustedstring(ab, data, size);
 			}
 			audit_set_pid(ab, pid);
_