| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20120919225659.GA11325@ghostprotocols.net>
Date: Wed, 19 Sep 2012 15:56:59 -0700
From: Arnaldo Carvalho de Melo <acme@...stprotocols.net>
To: Al Viro <viro@...iv.linux.org.uk>, Eric Paris <eparis@...hat.com>
Cc: David Ahern <dsahern@...il.com>,
Frederic Weisbecker <fweisbec@...il.com>,
Ingo Molnar <mingo@...nel.org>, Jiri Olsa <jolsa@...hat.com>,
Mike Galbraith <efault@....de>,
Namhyung Kim <namhyung@...il.com>,
Paul Mackerras <paulus@...ba.org>,
Peter Zijlstra <peterz@...radead.org>,
Stephane Eranian <eranian@...gle.com>,
Steven Rostedt <rostedt@...dmis.org>,
Thomas Gleixner <tglx@...utronix.de>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/1] audit: Use a tracepoint for getname
Al, Eric,
Was this considered before? Acceptable?
- Arnaldo
---
Instead of an explicit hook only for audit, use a tracepoint, so that
other users that need to know about filenames can hook there just like
audit.
Based on an earlier patch by Thomas Gleixner that added the tracepoint
but left the audit_getname call.
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
fs/namei.c | 5 ++++-
include/linux/audit.h | 6 +-----
include/trace/events/vfs.h | 32 ++++++++++++++++++++++++++++++++
init/Kconfig | 2 +-
kernel/audit.c | 11 +++++++++++
5 files changed, 49 insertions(+), 7 deletions(-)
create mode 100644 include/trace/events/vfs.h
diff --git a/fs/namei.c b/fs/namei.c
index dd1ed1b..e1462d1 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -39,6 +39,9 @@
#include "internal.h"
#include "mount.h"
+#define CREATE_TRACE_POINTS
+#include <trace/events/vfs.h>
+
/* [Feb-1997 T. Schoebel-Theuer]
* Fundamental changes in the pathname lookup mechanisms (namei)
* were necessary because of omirr. The reason is that omirr needs
@@ -141,7 +144,7 @@ static char *getname_flags(const char __user *filename, int flags, int *empty)
err = ERR_PTR(-ENAMETOOLONG);
if (likely(len < PATH_MAX)) {
- audit_getname(result);
+ trace_getname(result);
return result;
}
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 36abf2a..7ad39e0 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -493,11 +493,7 @@ static inline void audit_syscall_exit(void *pt_regs)
__audit_syscall_exit(success, return_code);
}
}
-static inline void audit_getname(const char *name)
-{
- if (unlikely(!audit_dummy_context()))
- __audit_getname(name);
-}
+
static inline void audit_inode(const char *name, const struct dentry *dentry) {
if (unlikely(!audit_dummy_context()))
__audit_inode(name, dentry);
diff --git a/include/trace/events/vfs.h b/include/trace/events/vfs.h
new file mode 100644
index 0000000..a6a5d1a
--- /dev/null
+++ b/include/trace/events/vfs.h
@@ -0,0 +1,32 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM vfs
+
+#if !defined(_TRACE_VFS_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_VFS_H_
+
+#include <linux/tracepoint.h>
+#include <linux/ftrace.h>
+
+TRACE_EVENT(getname,
+
+ TP_PROTO(const char *filename),
+
+ TP_ARGS(filename),
+
+ TP_STRUCT__entry(
+ __string( filename, filename);
+ ),
+
+ TP_fast_assign(
+ __assign_str(filename, filename);
+ ),
+
+ TP_printk("vfs_getname %s", __get_str(filename))
+);
+
+#undef NO_DEV
+
+#endif /* _TRACE_VFS_H_ */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/init/Kconfig b/init/Kconfig
index af6c7f8..63413ea 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -348,7 +348,7 @@ config TASK_IO_ACCOUNTING
config AUDIT
bool "Auditing support"
- depends on NET
+ depends on NET && TRACEPOINTS
help
Enable auditing infrastructure that can be used with another
kernel subsystem, such as SELinux (which requires this for
diff --git a/kernel/audit.c b/kernel/audit.c
index ea3b7b6..99cb039 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -64,6 +64,8 @@
#include "audit.h"
+#include <trace/events/vfs.h>
+
/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
* (Initialization happens after skb_init is called.) */
#define AUDIT_DISABLED -1
@@ -958,6 +960,12 @@ static void audit_receive(struct sk_buff *skb)
mutex_unlock(&audit_cmd_mutex);
}
+static void audit_getname(void *ignore, const char *name)
+{
+ if (unlikely(!audit_dummy_context()))
+ __audit_getname(name);
+}
+
/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
@@ -978,6 +986,9 @@ static int __init audit_init(void)
else
audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+ if (register_trace_getname(audit_getname, NULL))
+ audit_panic("cannot register getname tracepoint");
+
skb_queue_head_init(&audit_skb_queue);
skb_queue_head_init(&audit_skb_hold_queue);
audit_initialized = AUDIT_INITIALIZED;
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists