Register a netlink per-protocol bind fuction for audit to check userspace process capabilities before allowing a multicast group connection.
Signed-off-by: Richard Guy Briggs <[email protected]> --- kernel/audit.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index b5b2f72..f2d2d61 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1050,10 +1050,20 @@ static void audit_receive(struct sk_buff *skb) mutex_unlock(&audit_cmd_mutex); } +/* Run custom bind function on netlink socket group connect or bind requests. */ +static int audit_bind(int group) +{ + if (!capable(CAP_AUDIT_READ)) + return -EPERM; + + return 0; +} + static int __net_init audit_net_init(struct net *net) { struct netlink_kernel_cfg cfg = { .input = audit_receive, + .bind = audit_bind, }; struct audit_net *aunet = net_generic(net, audit_net_id); -- 1.7.1 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
