Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
大约 1 年 前同步成功

通知 153
Star 36
Fork 7
cloud-kernel
cloud-kernel

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 22 6月, 2006 7 次提交
  3. 21 6月, 2006 11 次提交
  5. 20 6月, 2006 22 次提交
    • A
      [PATCH] log more info for directory entry change events · 9c937dcc
      由 Amy Griffis 提交于 
      When an audit event involves changes to a directory entry, include
a PATH record for the directory itself.  A few other notable changes:

    - fixed audit_inode_child() hooks in fsnotify_move()
    - removed unused flags arg from audit_inode()
    - added audit log routines for logging a portion of a string

Here's some sample output.

before patch:
type=SYSCALL msg=audit(1149821605.320:26): arch=40000003 syscall=39 success=yes exit=0 a0=bf8d3c7c a1=1ff a2=804e1b8 a3=bf8d3c7c items=1 ppid=739 pid=800 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149821605.320:26):  cwd="/root"
type=PATH msg=audit(1149821605.320:26): item=0 name="foo" parent=164068 inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

after patch:
type=SYSCALL msg=audit(1149822032.332:24): arch=40000003 syscall=39 success=yes exit=0 a0=bfdd9c7c a1=1ff a2=804e1b8 a3=bfdd9c7c items=2 ppid=714 pid=777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149822032.332:24):  cwd="/root"
type=PATH msg=audit(1149822032.332:24): item=0 name="/root" inode=164068 dev=03:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_dir_t:s0
type=PATH msg=audit(1149822032.332:24): item=1 name="foo" inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0
Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      9c937dcc
    • A
      [PATCH] audit: path-based rules · f368c07d
      由 Amy Griffis 提交于 
      In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules.  When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event.  If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.

To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory.  Given
a path-based rule for /foo/bar/passwd, the following table applies:

    passwd modified -- audit event logged
    passwd replaced -- audit event logged, rules list updated
    bar renamed     -- rule removed
    foo renamed     -- untracked, meaning that the rule now applies to
		       the new location

Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance.  This
patch also adds an inode-number-based rule hash to mitigate this
situation.

The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      f368c07d
    • G
      [PATCH] Audit of POSIX Message Queue Syscalls v.2 · 20ca73bc
      由 George C. Wilson 提交于 
      This patch adds audit support to POSIX message queues.  It applies cleanly to
the lspp.b15 branch of Al Viro's git tree.  There are new auxiliary data
structures, and collection and emission routines in kernel/auditsc.c.  New hooks
in ipc/mqueue.c collect arguments from the syscalls.

I tested the patch by building the examples from the POSIX MQ library tarball.
Build them -lrt, not against the old MQ library in the tarball.  Here's the URL:
http://www.geocities.com/wronski12/posix_ipc/libmqueue-4.41.tar.gz
Do auditctl -a exit,always -S for mq_open, mq_timedsend, mq_timedreceive,
mq_notify, mq_getsetattr.  mq_unlink has no new hooks.  Please see the
corresponding userspace patch to get correct output from auditd for the new
record types.

[fixes folded]
Signed-off-by: NGeorge Wilson <ltcgcw@us.ibm.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      20ca73bc
    • A
      [PATCH] inline more audit helpers · d8945bb5
      由 Al Viro 提交于 
      pull checks for ->audit_context into inlined wrappers
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      d8945bb5
    • L
      [PATCH] update of IPC audit record cleanup · ac03221a
      由 Linda Knippers 提交于 
      The following patch addresses most of the issues with the IPC_SET_PERM
records as described in:
https://www.redhat.com/archives/linux-audit/2006-May/msg00010.html
and addresses the comments I received on the record field names.

To summarize, I made the following changes:

1. Changed sys_msgctl() and semctl_down() so that an IPC_SET_PERM
   record is emitted in the failure case as well as the success case.
   This matches the behavior in sys_shmctl().  I could simplify the
   code in sys_msgctl() and semctl_down() slightly but it would mean
   that in some error cases we could get an IPC_SET_PERM record
   without an IPC record and that seemed odd.

2. No change to the IPC record type, given no feedback on the backward
   compatibility question.

3. Removed the qbytes field from the IPC record.  It wasn't being
   set and when audit_ipc_obj() is called from ipcperms(), the
   information isn't available.  If we want the information in the IPC
   record, more extensive changes will be necessary.  Since it only
   applies to message queues and it isn't really permission related, it
   doesn't seem worth it.

4. Removed the obj field from the IPC_SET_PERM record.  This means that
   the kern_ipc_perm argument is no longer needed.

5. Removed the spaces and renamed the IPC_SET_PERM field names.  Replaced iuid and
   igid fields with ouid and ogid in the IPC record.

I tested this with the lspp.22 kernel on an x86_64 box.  I believe it
applies cleanly on the latest kernel.

-- ljk
Signed-off-by: NLinda Knippers <linda.knippers@hp.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      ac03221a
    • A
      [PATCH] add filtering by ppid · 3c66251e
      由 Al Viro 提交于 
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      3c66251e
    • A
      [PATCH] collect sid of those who send signals to auditd · e1396065
      由 Al Viro 提交于 
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      e1396065
    • A
      [PATCH] execve argument logging · 473ae30b
      由 Al Viro 提交于 
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      473ae30b
    • A
      [PATCH] audit_panic() is audit-internal · bc0f3b8e
      由 Al Viro 提交于 
      ... no need to provide a stub; note that extern is already gone from
include/linux/audit.h
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      bc0f3b8e
    • A
      [PATCH] inotify (4/5): allow watch removal from event handler · 3ca10067
      由 Amy Griffis 提交于 
      Allow callers to remove watches from their event handler via
inotify_remove_watch_locked().  This functionality can be used to
achieve IN_ONESHOT-like functionality for a subset of events in the
mask.
Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Acked-by: NRobert Love <rml@novell.com>
Acked-by: NJohn McCutchan <john@johnmccutchan.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      3ca10067
    • A
      [PATCH] inotify (3/5): add interfaces to kernel API · a9dc971d
      由 Amy Griffis 提交于 
      Add inotify_init_watch() so caller can use inotify_watch refcounts
before calling inotify_add_watch().

Add inotify_find_watch() to find an existing watch for an (ih,inode)
pair.  This is similar to inotify_find_update_watch(), but does not
update the watch's mask if one is found.

Add inotify_rm_watch() to remove a watch via the watch pointer instead
of the watch descriptor.
Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Acked-by: NRobert Love <rml@novell.com>
Acked-by: NJohn McCutchan <john@johnmccutchan.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      a9dc971d
    • A
      [PATCH] inotify (2/5): add name's inode to event handler · 7c297722
      由 Amy Griffis 提交于 
      When an inotify event includes a dentry name, also include the inode
associated with that name.
Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Acked-by: NRobert Love <rml@novell.com>
Acked-by: NJohn McCutchan <john@johnmccutchan.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      7c297722
    • A
      [PATCH] inotify (1/5): split kernel API from userspace support · 2d9048e2
      由 Amy Griffis 提交于 
      The following series of patches introduces a kernel API for inotify,
making it possible for kernel modules to benefit from inotify's
mechanism for watching inodes.  With these patches, inotify will
maintain for each caller a list of watches (via an embedded struct
inotify_watch), where each inotify_watch is associated with a
corresponding struct inode.  The caller registers an event handler and
specifies for which filesystem events their event handler should be
called per inotify_watch.
Signed-off-by: NAmy Griffis <amy.griffis@hp.com>
Acked-by: NRobert Love <rml@novell.com>
Acked-by: NJohn McCutchan <john@johnmccutchan.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      2d9048e2
    • A
      [PATCH] remove config.h from inotify.h · 90204e0b
      由 Al Viro 提交于 
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      90204e0b
    • D
      [SPARC64]: Move over to GENERIC_HARDIRQS. · e18e2a00
      由 David S. Miller 提交于 
      This is the long overdue conversion of sparc64 over to
the generic IRQ layer.

The kernel image is slightly larger, but the BSS is ~60K
smaller due to the reduced size of struct ino_bucket.

A lot of IRQ implementation details, including ino_bucket,
were moved out of asm-sparc64/irq.h and are now private to
arch/sparc64/kernel/irq.c, and most of the code in irq.c
totally disappeared.

One thing that's different at the moment is IRQ distribution,
we do it at enable_irq() time.  If the cpu mask is ALL then
we round-robin using a global rotating cpu counter, else
we pick the first cpu in the mask to support single cpu
targetting.  This is similar to what powerpc's XICS IRQ
support code does.

This works fine on my UP SB1000, and the SMP build goes
fine and runs on that machine, but lots of testing on
different setups is needed.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e18e2a00
    • D
      [SPARC64]: Virtualize IRQ numbers. · 8047e247
      由 David S. Miller 提交于 
      Inspired by PowerPC XICS interrupt support code.

All IRQs are virtualized in order to keep NR_IRQS from needing
to be too large.  Interrupts on sparc64 are arbitrary 11-bit
values, but we don't need to define NR_IRQS to 2048 if we
virtualize the IRQs.

As PCI and SBUS controller drivers build device IRQs, we divy
out virtual IRQ numbers incrementally starting at 1.  Zero is
a special virtual IRQ used for the timer interrupt.

So device drivers all see virtual IRQs, and all the normal
interfaces such as request_irq(), enable_irq(), etc. translate
that into a real IRQ number in order to configure the IRQ.

At this point knowledge of the struct ino_bucket is almost
entirely contained within arch/sparc64/kernel/irq.c  There are
a few small bits in the PCI controller drivers that need to
be swept away before we can remove ino_bucket's definition
out of asm-sparc64/irq.h and privately into kernel/irq.c
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8047e247
    • D
      [SPARC64]: Kill ino_bucket->pil · 37cdcd9e
      由 David S. Miller 提交于 
      And reuse that struct member for virt_irq, which will
be used in future changesets for the implementation of
mapping between real and virtual IRQ numbers.

This nicely kills off a ton of SBUS and PCI controller
PIL assignment code which is no longer necessary.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      37cdcd9e
    • D
      [SPARC]: Kill __irq_itoa(). · c6387a48
      由 David S. Miller 提交于 
      This ugly hack was long overdue to die.

It was a way to print out Sparc interrupts in a more freindly format,
since IRQ numbers were arbitrary opaque 32-bit integers which vectored
into PIL levels.  These 32-bit integers were not necessarily in the
0-->NR_IRQS range, but the PILs they vectored to were.

The idea now is that we will increase NR_IRQS a little bit and use a
virtual<-->real IRQ number mapping scheme similar to PowerPC.

That makes this IRQ printing hack irrelevant, and furthermore only a
handful of drivers actually used __irq_itoa() making it even less
useful.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c6387a48
    • D
      [SPARC64]: Send all device interrupts via one PIL. · fd0504c3
      由 David S. Miller 提交于 
      This is the first in a series of cleanups that will hopefully
allow a seamless attempt at using the generic IRQ handling
infrastructure in the Linux kernel.

Define PIL_DEVICE_IRQ and vector all device interrupts through
there.

Get rid of the ugly pil0_dummy_{bucket,desc}, instead vector
the timer interrupt directly to a specific handler since the
timer interrupt is the only event that will be signaled on
PIL 14.

The irq_worklist is now in the per-cpu trap_block[].
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fd0504c3
    • B
      [SPARC]: Add missing rw can_lock macros · 61fc12d8
      由 Bob Breuer 提交于 
      Fix a link failure by adding the missing can_lock macros for the rw
locks.
Signed-off-by: NBob Breuer <breuerr@mc.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      61fc12d8
    • B
      [SPARC]: Setup cpu_possible_map · 7202fb49
      由 Bob Breuer 提交于 
      Setup cpu_possible_map so the secondary cpus will get started.
Signed-off-by: NBob Breuer <breuerr@mc.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7202fb49
    • D
      [SCTP]: Fix unintentional change to SCTP_ASSERT when !SCTP_DEBUG · 65fd28f7
      由 David S. Miller 提交于 
      A local debugging change slipped into a previous changeset.

When SCTP_DEBUG is off SCTP_ASSERT should do nothing.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      65fd28f7