• P
    audit: netlink socket can be auto-bound to pid other than current->pid (v2) · 75c0371a
    Pavel Emelyanov 提交于
    From:	Pavel Emelyanov <xemul@openvz.org>
    
    This patch is based on the one from Thomas.
    
    The kauditd_thread() calls the netlink_unicast() and passes 
    the audit_pid to it. The audit_pid, in turn, is received from 
    the user space and the tool (I've checked the audit v1.6.9) 
    uses getpid() to pass one in the kernel. Besides, this tool 
    doesn't bind the netlink socket to this id, but simply creates 
    it allowing the kernel to auto-bind one.
    
    That's the preamble.
    
    The problem is that netlink_autobind() _does_not_ guarantees
    that the socket will be auto-bound to the current pid. Instead
    it uses the current pid as a hint to start looking for a free
    id. So, in case of conflict, the audit messages can be sent
    to a wrong socket. This can happen (it's unlikely, but can be)
    in case some task opens more than one netlink sockets and then
    the audit one starts - in this case the audit's pid can be busy
    and its socket will be bound to another id.
    
    The proposal is to introduce an audit_nlk_pid in audit subsys,
    that will point to the netlink socket to send packets to. It
    will most often be equal to audit_pid. The socket id can be 
    got from the skb's netlink CB right in the audit_receive_msg.
    The audit_nlk_pid reset to 0 is not required, since all the
    decisions are taken based on audit_pid value only.
    
    Later, if the audit tools will bind the socket themselves, the
    kernel will have to provide a way to setup the audit_nlk_pid
    as well.
    
    A good side effect of this patch is that audit_pid can later 
    be converted to struct pid, as it is not longer safe to use 
    pid_t-s in the presence of pid namespaces. But audit code still 
    uses the tgid from task_struct in the audit_signal_info and in
    the audit_filter_syscall.
    Signed-off-by: NThomas Graf <tgraf@suug.ch>
    Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
    Acked-by: NEric Paris <eparis@redhat.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    75c0371a
audit.c 36.4 KB