• R
    audit: call audit_bprm() only once to add AUDIT_EXECVE information · 9410d228
    Richard Guy Briggs 提交于
    Move the audit_bprm() call from search_binary_handler() to exec_binprm().  This
    allows us to get rid of the mm member of struct audit_aux_data_execve since
    bprm->mm will equal current->mm.
    
    This also mitigates the issue that ->argc could be modified by the
    load_binary() call in search_binary_handler().
    
    audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
    context every time search_binary_handler() was recursively called.  Only one
    reference is necessary.
    Reported-by: NOleg Nesterov <onestero@redhat.com>
    Cc: Eric Paris <eparis@redhat.com>
    Signed-off-by: NRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: NEric Paris <eparis@redhat.com>
    ---
    This patch is against 3.11, but was developed on Oleg's post-3.11 patches that
    introduce exec_binprm().
    9410d228
audit.h 15.9 KB