On Tue, Aug 29, 2023 at 07:51:58PM +0200, Phil Sutter wrote:
> Resetting rules' stateful data happens outside of the transaction logic,
> so 'get' and 'dump' handlers have to emit audit log entries themselves.
> 
> Cc: Richard Guy Briggs <r...@redhat.com>
> Fixes: 8daa8fde3fc3f ("netfilter: nf_tables: Introduce NFT_MSG_GETRULE_RESET")
> Signed-off-by: Phil Sutter <p...@nwl.cc>
> ---
>  include/linux/audit.h         |  1 +
>  kernel/auditsc.c              |  1 +
>  net/netfilter/nf_tables_api.c | 18 ++++++++++++++++++
>  3 files changed, 20 insertions(+)
> 
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 192bf03aacc52..51b1b7054a233 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -118,6 +118,7 @@ enum audit_nfcfgop {
>       AUDIT_NFT_OP_FLOWTABLE_REGISTER,
>       AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
>       AUDIT_NFT_OP_SETELEM_RESET,
> +     AUDIT_NFT_OP_RULE_RESET,
>       AUDIT_NFT_OP_INVALID,
>  };
>  
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 38481e3181975..fc0c7c03eeabe 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -144,6 +144,7 @@ static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
>       { AUDIT_NFT_OP_FLOWTABLE_REGISTER,      "nft_register_flowtable"   },
>       { AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,    "nft_unregister_flowtable" },
>       { AUDIT_NFT_OP_SETELEM_RESET,           "nft_reset_setelem"        },
> +     { AUDIT_NFT_OP_RULE_RESET,              "nft_reset_rule"           },
>       { AUDIT_NFT_OP_INVALID,                 "nft_invalid"              },
>  };
>  
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index a1218ea4e0c3d..2aa7b9a55cca4 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -3432,6 +3432,18 @@ static void nf_tables_rule_notify(const struct nft_ctx 
> *ctx,
>       nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
>  }
>  
> +static void audit_log_rule_reset(const struct nft_table *table,
> +                              unsigned int base_seq,
> +                              unsigned int nentries)
> +{
> +     char *buf = kasprintf(GFP_ATOMIC, "%s:%u",
> +                           table->name, base_seq);

No check for NULL.

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Reply via email to