A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 18:51:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[PATCH] fix missed create event for directory audit

Browse source 
When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].

Signed-off-by: Amy Griffis <[email protected]>
Signed-off-by: Al Viro <[email protected]>
This commit is contained in:
Amy Griffis 2006-07-13 13:16:39 -04:00 • committed by Al Viro
commit 73d3ec5aba
4 changed files with 21 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

16
kernel/auditsc.c
View file

@ -1251,7 +1251,7 @@ void __audit_inode(const char *name, const struct inode *inode)
* audit_inode_child - collect inode info for created/removed objects
* @dname: inode's dentry name
* @inode: inode being audited
* @pino: inode number of dentry parent
* @parent: inode of dentry parent
*
* For syscalls that create or remove filesystem objects, audit_inode
* can only collect information for the filesystem object's parent.
@ -1262,7 +1262,7 @@ void __audit_inode(const char *name, const struct inode *inode)
* unsuccessful attempts.
*/
void __audit_inode_child(const char *dname, const struct inode *inode,
unsigned long pino)
const struct inode *parent)
{
int idx;
struct audit_context *context = current->audit_context;
@ -1276,7 +1276,7 @@ void __audit_inode_child(const char *dname, const struct inode *inode,
if (!dname)
goto update_context;
for (idx = 0; idx < context->name_count; idx++)
if (context->names[idx].ino == pino) {
if (context->names[idx].ino == parent->i_ino) {
const char *name = context->names[idx].name;
if (!name)
@ -1304,6 +1304,16 @@ update_context:
context->names[idx].ino = (unsigned long)-1;
else
audit_copy_inode(&context->names[idx], inode);
/* A parent was not found in audit_names, so copy the inode data for the
* provided parent. */
if (!found_name) {
idx = context->name_count++;
#if AUDIT_DEBUG
context->ino_count++;
#endif
audit_copy_inode(&context->names[idx], parent);
}
}
/**