The patch titled
audit: let userspace fully control TTY input auditing
has been added to the -mm tree. Its filename is
audit-let-userspace-fully-control-tty-input-auditing.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: audit: let userspace fully control TTY input auditing
From: Miloslav Trmac <[EMAIL PROTECTED]>
Remove the code that automatically disables TTY input auditing in processes
that open TTYs when they have no other TTY open; this heuristic was
intended to automatically handle daemons, but it has false positives (e.g.
with sshd) that make it impossible to control TTY input auditing from a PAM
module. With this patch, TTY input auditing is controlled from user-space
only.
On the other hand, not even for daemons does it make sense to audit "input"
from PTY masters; this data was produced by a program writing to the PTY
slave, and does not represent data entered by the user.
Signed-off-by: Miloslav Trmac <[EMAIL PROTECTED]>
Cc: Al Viro <[EMAIL PROTECTED]>
Cc: David Woodhouse <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
---
drivers/char/tty_audit.c | 54 ++-----------------------------------
drivers/char/tty_io.c | 5 ---
include/linux/tty.h | 5 ---
3 files changed, 5 insertions(+), 59 deletions(-)
diff -puN
drivers/char/tty_audit.c~audit-let-userspace-fully-control-tty-input-auditing
drivers/char/tty_audit.c
---
a/drivers/char/tty_audit.c~audit-let-userspace-fully-control-tty-input-auditing
+++ a/drivers/char/tty_audit.c
@@ -238,6 +238,10 @@ void tty_audit_add_data(struct tty_struc
if (unlikely(size == 0))
return;
+ if (tty->driver->type == TTY_DRIVER_TYPE_PTY
+ && tty->driver->subtype == PTY_TYPE_MASTER)
+ return;
+
buf = tty_audit_buf_get(tty);
if (!buf)
return;
@@ -300,53 +304,3 @@ void tty_audit_push(struct tty_struct *t
tty_audit_buf_put(buf);
}
}
-
-/**
- * tty_audit_opening - A TTY is being opened.
- *
- * As a special hack, tasks that close all their TTYs and open new ones
- * are assumed to be system daemons (e.g. getty) and auditing is
- * automatically disabled for them.
- */
-void tty_audit_opening(void)
-{
- int disable;
-
- disable = 1;
- spin_lock_irq(¤t->sighand->siglock);
- if (current->signal->audit_tty == 0)
- disable = 0;
- spin_unlock_irq(¤t->sighand->siglock);
- if (!disable)
- return;
-
- task_lock(current);
- if (current->files) {
- struct fdtable *fdt;
- unsigned i;
-
- /*
- * We don't take a ref to the file, so we must hold ->file_lock
- * instead.
- */
- spin_lock(¤t->files->file_lock);
- fdt = files_fdtable(current->files);
- for (i = 0; i < fdt->max_fds; i++) {
- struct file *filp;
-
- filp = fcheck_files(current->files, i);
- if (filp && is_tty(filp)) {
- disable = 0;
- break;
- }
- }
- spin_unlock(¤t->files->file_lock);
- }
- task_unlock(current);
- if (!disable)
- return;
-
- spin_lock_irq(¤t->sighand->siglock);
- current->signal->audit_tty = 0;
- spin_unlock_irq(¤t->sighand->siglock);
-}
diff -puN
drivers/char/tty_io.c~audit-let-userspace-fully-control-tty-input-auditing
drivers/char/tty_io.c
--- a/drivers/char/tty_io.c~audit-let-userspace-fully-control-tty-input-auditing
+++ a/drivers/char/tty_io.c
@@ -2710,7 +2710,6 @@ got_driver:
__proc_set_tty(current, tty);
spin_unlock_irq(¤t->sighand->siglock);
mutex_unlock(&tty_mutex);
- tty_audit_opening();
return 0;
}
@@ -2773,10 +2772,8 @@ static int ptmx_open(struct inode * inod
check_tty_count(tty, "tty_open");
retval = ptm_driver->open(tty, filp);
- if (!retval) {
- tty_audit_opening();
+ if (!retval)
return 0;
- }
out1:
release_dev(filp);
return retval;
diff -puN
include/linux/tty.h~audit-let-userspace-fully-control-tty-input-auditing
include/linux/tty.h
--- a/include/linux/tty.h~audit-let-userspace-fully-control-tty-input-auditing
+++ a/include/linux/tty.h
@@ -307,7 +307,6 @@ extern void tty_hangup(struct tty_struct
extern void tty_vhangup(struct tty_struct * tty);
extern void tty_unhangup(struct file *filp);
extern int tty_hung_up_p(struct file * filp);
-extern int is_tty(struct file *filp);
extern void do_SAK(struct tty_struct *tty);
extern void __do_SAK(struct tty_struct *tty);
extern void disassociate_ctty(int priv);
@@ -359,7 +358,6 @@ extern void tty_audit_exit(void);
extern void tty_audit_fork(struct signal_struct *sig);
extern void tty_audit_push(struct tty_struct *tty);
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid);
-extern void tty_audit_opening(void);
#else
static inline void tty_audit_add_data(struct tty_struct *tty,
unsigned char *data, size_t size)
@@ -377,9 +375,6 @@ static inline void tty_audit_push(struct
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
{
}
-static inline void tty_audit_opening(void)
-{
-}
#endif
/* tty_ioctl.c */
_
Patches currently in -mm which might be from [EMAIL PROTECTED] are
audit-let-userspace-fully-control-tty-input-auditing.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
