On Thu, Apr 18, 2013 at 03:31:36PM -0400, Miloslav Trmač wrote: > Hello,
Mirek, > ----- Original Message ----- > > Full replacement patch: > > I'm still convinced that icanon is not the correct condition, see > https://www.redhat.com/archives/linux-audit/2013-March/msg00052.html . As I indicated in a previous email, from my testing, you are correct. This patch appended should address that. Comments? > Mirek - RGB drivers/tty/tty_audit.c | 8 ++++++++ include/linux/sched.h | 1 + include/uapi/linux/audit.h | 3 ++- kernel/audit.c | 5 ++++- 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c index 6953dc8..dc1bf78 100644 --- a/drivers/tty/tty_audit.c +++ b/drivers/tty/tty_audit.c @@ -153,6 +153,7 @@ void tty_audit_fork(struct signal_struct *sig) { spin_lock_irq(¤t->sighand->siglock); sig->audit_tty = current->signal->audit_tty; + sig->audit_tty_log_icanon = current->signal->audit_tty_log_icanon; spin_unlock_irq(¤t->sighand->siglock); } @@ -292,10 +293,17 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, { struct tty_audit_buf *buf; int major, minor; + int audit_log_tty_icanon; if (unlikely(size == 0)) return; + spin_lock_irq(¤t->sighand->siglock); + audit_log_tty_icanon = current->signal->audit_tty_log_icanon; + spin_unlock_irq(¤t->sighand->siglock); + if (!audit_log_tty_icanon && icanon && !L_ECHO(tty)) + return; + if (tty->driver->type == TTY_DRIVER_TYPE_PTY && tty->driver->subtype == PTY_TYPE_MASTER) return; diff --git a/include/linux/sched.h b/include/linux/sched.h index d35d2b6..031aa39 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -606,6 +606,7 @@ struct signal_struct { #endif #ifdef CONFIG_AUDIT unsigned audit_tty; + unsigned audit_tty_log_icanon; struct tty_audit_buf *tty_audit_buf; #endif #ifdef CONFIG_CGROUPS diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 9f096f1..a863669 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -369,7 +369,8 @@ struct audit_status { }; struct audit_tty_status { - __u32 enabled; /* 1 = enabled, 0 = disabled */ + __u32 enabled; /* 1 = enabled, 0 = disabled */ + __u32 log_icanon; /* 1 = enabled, 0 = disabled */ }; /* audit_rule_data supports filter rules with both integer and string diff --git a/kernel/audit.c b/kernel/audit.c index d596e53..98d43c6 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -873,6 +873,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) spin_lock_irq(&tsk->sighand->siglock); s.enabled = tsk->signal->audit_tty != 0; + s.log_icanon = tsk->signal->audit_tty_log_icanon != 0; spin_unlock_irq(&tsk->sighand->siglock); audit_send_reply(NETLINK_CB(skb).portid, seq, @@ -886,11 +887,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) if (nlh->nlmsg_len < sizeof(struct audit_tty_status)) return -EINVAL; s = data; - if (s->enabled != 0 && s->enabled != 1) + if (s->enabled != 0 && s->enabled != 1 + && s->log_icanon != 0 && s->log_icanon != 1) return -EINVAL; spin_lock_irq(&tsk->sighand->siglock); tsk->signal->audit_tty = s->enabled != 0; + tsk->signal->audit_tty_log_icanon = s->log_icanon != 0; spin_unlock_irq(&tsk->sighand->siglock); break; } -- 1.7.1 -- Richard Guy Briggs <rbri...@redhat.com> Senior Software Engineer AMER ENG Base Operating Systems Remote, Canada, Ottawa Voice: 1.647.777.2635 Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
