Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

audit: create audit_stamp structure 

Replace the timestamp and serial number pair used in audit records
with a structure containing the two elements.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subj tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2025-08-16 10:28:56 -07:00 committed by Paul Moore
parent 70d0085864
commit 0a561e3904
3 changed files with 27 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
kernel/audit.c
View File

@ -1833,11 +1833,11 @@ unsigned int audit_serial(void)
} }
static inline void audit_get_stamp(struct audit_context *ctx, static inline void audit_get_stamp(struct audit_context *ctx,
struct timespec64 *t, unsigned int *serial) struct audit_stamp *stamp)
{ {
if (!ctx || !auditsc_get_stamp(ctx, t, serial)) { if (!ctx || !auditsc_get_stamp(ctx, stamp)) {
ktime_get_coarse_real_ts64(t); ktime_get_coarse_real_ts64(&stamp->ctime);
*serial = audit_serial(); stamp->serial = audit_serial();
} }
} }
@ -1860,8 +1860,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
int type) int type)
{ {
struct audit_buffer *ab; struct audit_buffer *ab;
struct timespec64 t; struct audit_stamp stamp;
unsigned int serial;
if (audit_initialized != AUDIT_INITIALIZED) if (audit_initialized != AUDIT_INITIALIZED)
return NULL; return NULL;
@ -1916,12 +1915,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
return NULL; return NULL;
} }
audit_get_stamp(ab->ctx, &t, &serial); audit_get_stamp(ab->ctx, &stamp);
/* cancel dummy context to enable supporting records */ /* cancel dummy context to enable supporting records */
if (ctx) if (ctx)
ctx->dummy = 0; ctx->dummy = 0;
audit_log_format(ab, "audit(%llu.%03lu:%u): ", audit_log_format(ab, "audit(%llu.%03lu:%u): ",
(unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); (unsigned long long)stamp.ctime.tv_sec,
stamp.ctime.tv_nsec/1000000,
stamp.serial);
return ab; return ab;
} }

13
kernel/audit.h
View File

@ -99,6 +99,12 @@ struct audit_proctitle {
char *value; /* the cmdline field */ char *value; /* the cmdline field */
}; };
/* A timestamp/serial pair to identify an event */
struct audit_stamp {
struct timespec64 ctime; /* time of syscall entry */
unsigned int serial; /* serial number for record */
};
/* The per-task audit context. */ /* The per-task audit context. */
struct audit_context { struct audit_context {
int dummy; /* must be the first element */ int dummy; /* must be the first element */
@ -108,10 +114,9 @@ struct audit_context {
AUDIT_CTX_URING, /* in use by io_uring */ AUDIT_CTX_URING, /* in use by io_uring */
} context; } context;
enum audit_state state, current_state; enum audit_state state, current_state;
unsigned int serial; /* serial number for record */ struct audit_stamp stamp; /* event identifier */
int major; /* syscall number */ int major; /* syscall number */
int uring_op; /* uring operation */ int uring_op; /* uring operation */
struct timespec64 ctime; /* time of syscall entry */
unsigned long argv[4]; /* syscall arguments */ unsigned long argv[4]; /* syscall arguments */
long return_code;/* syscall return code */ long return_code;/* syscall return code */
u64 prio; u64 prio;
@ -263,7 +268,7 @@ extern void audit_put_tty(struct tty_struct *tty);
extern unsigned int audit_serial(void); extern unsigned int audit_serial(void);
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
extern int auditsc_get_stamp(struct audit_context *ctx, extern int auditsc_get_stamp(struct audit_context *ctx,
struct timespec64 *t, unsigned int *serial); struct audit_stamp *stamp);
extern void audit_put_watch(struct audit_watch *watch); extern void audit_put_watch(struct audit_watch *watch);
extern void audit_get_watch(struct audit_watch *watch); extern void audit_get_watch(struct audit_watch *watch);
@ -304,7 +309,7 @@ extern void audit_filter_inodes(struct task_struct *tsk,
struct audit_context *ctx); struct audit_context *ctx);
extern struct list_head *audit_killed_trees(void); extern struct list_head *audit_killed_trees(void);
#else /* CONFIG_AUDITSYSCALL */ #else /* CONFIG_AUDITSYSCALL */
#define auditsc_get_stamp(c, t, s) 0 #define auditsc_get_stamp(c, s) 0
#define audit_put_watch(w) do { } while (0) #define audit_put_watch(w) do { } while (0)
#define audit_get_watch(w) do { } while (0) #define audit_get_watch(w) do { } while (0)
#define audit_to_watch(k, p, l, o) (-EINVAL) #define audit_to_watch(k, p, l, o) (-EINVAL)

22
kernel/auditsc.c
View File

@ -994,10 +994,10 @@ static void audit_reset_context(struct audit_context *ctx)
*/ */
ctx->current_state = ctx->state; ctx->current_state = ctx->state;
ctx->serial = 0; ctx->stamp.serial = 0;
ctx->stamp.ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
ctx->major = 0; ctx->major = 0;
ctx->uring_op = 0; ctx->uring_op = 0;
ctx->ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
memset(ctx->argv, 0, sizeof(ctx->argv)); memset(ctx->argv, 0, sizeof(ctx->argv));
ctx->return_code = 0; ctx->return_code = 0;
ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0); ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0);
@ -1918,7 +1918,7 @@ void __audit_uring_entry(u8 op)
ctx->context = AUDIT_CTX_URING; ctx->context = AUDIT_CTX_URING;
ctx->current_state = ctx->state; ctx->current_state = ctx->state;
ktime_get_coarse_real_ts64(&ctx->ctime); ktime_get_coarse_real_ts64(&ctx->stamp.ctime);
} }
/** /**
@ -2040,7 +2040,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
context->argv[3] = a4; context->argv[3] = a4;
context->context = AUDIT_CTX_SYSCALL; context->context = AUDIT_CTX_SYSCALL;
context->current_state = state; context->current_state = state;
ktime_get_coarse_real_ts64(&context->ctime); ktime_get_coarse_real_ts64(&context->stamp.ctime);
} }
/** /**
@ -2509,21 +2509,17 @@ EXPORT_SYMBOL_GPL(__audit_inode_child);
/** /**
* auditsc_get_stamp - get local copies of audit_context values * auditsc_get_stamp - get local copies of audit_context values
* @ctx: audit_context for the task * @ctx: audit_context for the task
* @t: timespec64 to store time recorded in the audit_context * @stamp: timestamp to record
* @serial: serial value that is recorded in the audit_context
* *
* Also sets the context as auditable. * Also sets the context as auditable.
*/ */
int auditsc_get_stamp(struct audit_context *ctx, int auditsc_get_stamp(struct audit_context *ctx, struct audit_stamp *stamp)
struct timespec64 *t, unsigned int *serial)
{ {
if (ctx->context == AUDIT_CTX_UNUSED) if (ctx->context == AUDIT_CTX_UNUSED)
return 0; return 0;
if (!ctx->serial) if (!ctx->stamp.serial)
ctx->serial = audit_serial(); ctx->stamp.serial = audit_serial();
t->tv_sec = ctx->ctime.tv_sec; *stamp = ctx->stamp;
t->tv_nsec = ctx->ctime.tv_nsec;
*serial = ctx->serial;
if (!ctx->prio) { if (!ctx->prio) {
ctx->prio = 1; ctx->prio = 1;
ctx->current_state = AUDIT_STATE_RECORD; ctx->current_state = AUDIT_STATE_RECORD;