linux-kernel - [PATCH] audit: skip klog-fowarding if mcasts were sent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 31 Dec 2014 13:20:50 +0100
From:	David Herrmann <dh.herrmann@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	Eric Paris <eparis@...hat.com>,
	Lennart Poettering <lennart@...ttering.net>,
	David Herrmann <dh.herrmann@...il.com>
Subject: [PATCH] audit: skip klog-fowarding if mcasts were sent

We currently skip forwarding audit messages to the kernel-log if auditd is
running. However, if auditd is not running, but there are multicast
listeners, we still forward those messages to the kerne-log. This causes
generic log-daemons to get audit messages twice if auditd is not running.
Once via the multicast message, and once via the kernel-log. As the
kernel-log is much less convenient to parse, compared to netlink audit
messages, we'd like to avoid dropping netlink support again.

Therefore, this patch makes the audit infrastructure forward audit
messages only to the kernel-log if neither auditd nor a multicast
listener is present.

Signed-off-by: David Herrmann <dh.herrmann@...il.com>
---
 kernel/audit.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 80983df..c087c6a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -429,14 +429,9 @@ static void kauditd_send_skb(struct sk_buff *skb)
  * This function doesn't consume an skb as might be expected since it has to
  * copy it anyways.
  */
-static void kauditd_send_multicast_skb(struct sk_buff *skb)
+static void kauditd_send_multicast_skb(struct sock *sock, struct sk_buff *skb)
 {
 	struct sk_buff		*copy;
-	struct audit_net	*aunet = net_generic(&init_net, audit_net_id);
-	struct sock		*sock = aunet->nlsk;
-
-	if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
-		return;
 
 	/*
 	 * The seemingly wasteful skb_copy() rather than bumping the refcount
@@ -1947,9 +1942,14 @@ void audit_log_end(struct audit_buffer *ab)
 		audit_log_lost("rate limit exceeded");
 	} else {
 		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
+		struct audit_net *aunet = net_generic(&init_net, audit_net_id);
+		struct sock *sock = aunet->nlsk;
+		bool has_mc = netlink_has_listeners(sock, AUDIT_NLGRP_READLOG);
 
 		nlh->nlmsg_len = ab->skb->len;
-		kauditd_send_multicast_skb(ab->skb);
+
+		if (has_mc)
+			kauditd_send_multicast_skb(sock, ab->skb);
 
 		/*
 		 * The original kaudit unicast socket sends up messages with
@@ -1965,8 +1965,10 @@ void audit_log_end(struct audit_buffer *ab)
 		if (audit_pid) {
 			skb_queue_tail(&audit_skb_queue, ab->skb);
 			wake_up_interruptible(&kauditd_wait);
-		} else {
+		} else if (!has_mc) {
 			audit_printk_skb(ab->skb);
+		} else {
+			audit_hold_skb(ab->skb);
 		}
 		ab->skb = NULL;
 	}
-- 
2.2.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/