The attached patch addresses the problem with getting the audit daemon

shutdown credential information. It creates a new message type
AUDIT_TERM_INFO, which is used by the audit daemon to query who issued the
shutdown.

It requires the placement of a hook function that gathers the information. The
hook is after the DAC & MAC checks and before the function returns. Racing
threads could overwrite the uid & pid - but they would have to be root and
have policy that allows signalling the audit daemon. That should be a
manageable risk.

The userspace component will be released later in audit 0.7.2. When it
receives the TERM signal, it queries the kernel for shutdown information.
When it receives it, it writes the message and exits. The message looks
like this:

type=DAEMON msg=auditd(1114551182.000) auditd normal halt, sending pid=2650
uid=525, auditd pid=1685

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 19f04b04979878ffcfa2706a9acb98421537226d..baa80760824c482fc72e921ef8ed201cf97147df 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -28,14 +28,16 @@
 #include <linux/elf.h>
 
 /* Request and reply types */
-#define AUDIT_GET      1000    /* Get status */
-#define AUDIT_SET      1001    /* Set status (enable/disable/auditd) */
-#define AUDIT_LIST     1002    /* List filtering rules */
-#define AUDIT_ADD      1003    /* Add filtering rule */
-#define AUDIT_DEL      1004    /* Delete filtering rule */
-#define AUDIT_USER     1005    /* Send a message from user-space */
-#define AUDIT_LOGIN    1006     /* Define the login id and informaiton */
-#define AUDIT_KERNEL   2000    /* Asynchronous audit record. NOT A REQUEST. */
+#define AUDIT_GET              1000    /* Get status */
+#define AUDIT_SET              1001    /* Set status (enable/disable/auditd) */
+#define AUDIT_LIST             1002    /* List filtering rules */
+#define AUDIT_ADD              1003    /* Add filtering rule */
+#define AUDIT_DEL              1004    /* Delete filtering rule */
+#define AUDIT_USER             1005    /* Send a message from user-space */
+#define AUDIT_LOGIN            1006    /* Define the login id and information */
+#define AUDIT_SIGNAL_INFO      1010    /* Get information about sender of signal*/
+
+#define AUDIT_KERNEL           2000    /* Asynchronous audit record. NOT A REQUEST. */
 
 /* Rule flags */
 #define AUDIT_PER_TASK 0x01    /* Apply rule at task creation (not syscall) */
@@ -161,6 +163,11 @@ struct audit_rule {                /* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */
 
 #ifdef __KERNEL__
 
+struct audit_sig_info {
+       uid_t           uid;
+       pid_t           pid;
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;
@@ -190,6 +197,7 @@ extern void audit_get_stamp(struct audit_context *ctx,
 extern int  audit_set_loginuid(struct task_struct *task, uid_t loginuid);
 extern uid_t audit_get_loginuid(struct audit_context *ctx);
 extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);
+extern void audit_signal_info(int sig, struct task_struct *t);
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
@@ -200,6 +208,7 @@ extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mo
 #define audit_inode(n,i) do { ; } while (0)
 #define audit_get_loginuid(c) ({ -1; })
 #define audit_ipc_perms(q,u,g,m) ({ 0; })
+#define audit_signal_info(s,t) do { ; } while (0)
 #endif
 
 #ifdef CONFIG_AUDIT

diff --git a/kernel/audit.c b/kernel/audit.c
index 9c4f1af0c794674404810d7caff0131218cbc950..6f344b44d3d3e6320335427050aec9c04598ba23 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -68,7 +68,7 @@ static int    audit_failure = AUDIT_FAIL_PRINTK;
 
 /* If audit records are to be written to the netlink socket, audit_pid
  * contains the (non-zero) pid. */
-static int     audit_pid;
+int            audit_pid;
 
 /* If audit_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -79,6 +79,10 @@ static int   audit_rate_limit;
 static int     audit_backlog_limit = 64;
 static atomic_t        audit_backlog       = ATOMIC_INIT(0);
 
+/* The identity of the user shutting down the audit system. */
+uid_t          audit_sig_uid = -1;
+pid_t          audit_sig_pid = -1;
+
 /* Records can be lost in several ways:
    0) [suppressed in audit_alloc]
    1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
@@ -321,6 +325,7 @@ static int audit_netlink_ok(kernel_cap_t eff_cap, u16 msg_type)
        case AUDIT_SET:
        case AUDIT_ADD:
        case AUDIT_DEL:
+       case AUDIT_SIGNAL_INFO:
                if (!cap_raised(eff_cap, CAP_AUDIT_CONTROL))
                        err = -EPERM;
                break;
@@ -344,6 +349,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct audit_buffer     *ab;
        u16                     msg_type = nlh->nlmsg_type;
        uid_t                   loginuid; /* loginuid of sender */
+       struct audit_sig_info   sig_data;
 
        err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type);
        if (err)
@@ -419,6 +425,12 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                err = -EOPNOTSUPP;
 #endif
                break;
+       case AUDIT_SIGNAL_INFO:
+               sig_data.uid = audit_sig_uid;
+               sig_data.pid = audit_sig_pid;
+               audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 
+                               0, 0, &sig_data, sizeof(sig_data));
+               break;
        default:
                err = -EINVAL;
                break;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 37b3ac94bc47492d026ae697cc92b1d4ddd70bd5..f1bf66510cd3e9817d44ab70cbf44e6192321840 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1056,3 +1056,22 @@ int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
        context->aux = (void *)ax;
        return 0;
 }
+
+void audit_signal_info(int sig, struct task_struct *t)
+{
+       extern pid_t audit_sig_pid;
+       extern uid_t audit_sig_uid;
+       extern int audit_pid;
+
+       if (unlikely(audit_pid && t->pid == audit_pid)) {
+               if (sig == SIGTERM || sig == SIGHUP) {
+                       struct audit_context *ctx = current->audit_context;
+                       audit_sig_pid = current->pid;
+                       if (ctx)
+                               audit_sig_uid = ctx->loginuid;
+                       else
+                               audit_sig_uid = current->uid;
+               }
+       }
+}
+

diff --git a/kernel/signal.c b/kernel/signal.c
index 8f3debc77c5b2c6db5c7e360d18f9d2e2502a068..293e189d8bc3ccfadb6eb7e445c9f4822fffa999 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -24,6 +24,7 @@
 #include <linux/ptrace.h>
 #include <linux/posix-timers.h>
 #include <linux/signal.h>
+#include <linux/audit.h>
 #include <asm/param.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -658,7 +659,11 @@ static int check_kill_permission(int sig, struct siginfo *info,
            && (current->uid ^ t->suid) && (current->uid ^ t->uid)
            && !capable(CAP_KILL))
                return error;
-       return security_task_kill(t, info, sig);
+
+       error = security_task_kill(t, info, sig);
+       if (!error)
+               audit_signal_info(sig, t); /* Let audit system see the signal */
+       return error;
 }
 
 /* forward decl */

diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index b3adb481bc250bf49c5a82aad706c6bf8c7b16db..deac14367d438c2d7eddb7b056a2a6d06b4c3090 100644 (file)
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -97,6 +97,7 @@ static struct nlmsg_perm nlmsg_audit_perms[] =
        { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
        { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
+       { AUDIT_SIGNAL_INFO,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
 };