linux-kernel - Re: [PATCH V2 2/3] audit: bail ASAP on syscall entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHC9VhT1B8bEu5w+U+oYFQbR8m7upk8x3o8qbQ7ZPa9ijE21uA@mail.gmail.com>
Date:   Wed, 14 Feb 2018 16:09:42 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Richard Guy Briggs <rgb@...hat.com>
Cc:     Linux-Audit Mailing List <linux-audit@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Eric Paris <eparis@...hat.com>, Steve Grubb <sgrubb@...hat.com>
Subject: Re: [PATCH V2 2/3] audit: bail ASAP on syscall entry

On Fri, Feb 9, 2018 at 9:40 PM, Richard Guy Briggs <rgb@...hat.com> wrote:
> Since removing the audit entry filter, test for early return before
> setting up any context state.
>
> Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
> ---
>  kernel/auditsc.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)

Sigh.

First off, thanks for making the changes, I think the end result of
1/3+2/3 is better than the v1 patch.

However, this really didn't need to be two patches, please combine 1/3
and 2/3 and resubmit.  I know I've done the patch squashing for you in
the past, but I think it's time to start pushing some of this work
back to you.

Moving forward, if I provide feedback and do not explicitly suggest
creating a new patch, please incorporate the changes into the existing
patches.

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 9348302..bc534bf 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1519,23 +1519,23 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
>         if (!audit_enabled)
>                 return;
>
> -       context->arch       = syscall_get_arch();
> -       context->major      = major;
> -       context->argv[0]    = a1;
> -       context->argv[1]    = a2;
> -       context->argv[2]    = a3;
> -       context->argv[3]    = a4;
> -
>         state = context->state;
> +       if (state == AUDIT_DISABLED)
> +               return;
> +
>         context->dummy = !audit_n_rules;
>         if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
>                 context->prio = 0;
>                 if (auditd_test_task(tsk))
>                         return;
>         }
> -       if (state == AUDIT_DISABLED)
> -               return;
>
> +       context->arch       = syscall_get_arch();
> +       context->major      = major;
> +       context->argv[0]    = a1;
> +       context->argv[1]    = a2;
> +       context->argv[2]    = a3;
> +       context->argv[3]    = a4;
>         context->serial     = 0;
>         context->ctime = current_kernel_time64();
>         context->in_syscall = 1;
> --
> 1.8.3.1
>



-- 
paul moore
www.paul-moore.com