You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
142 lines
4.1 KiB
142 lines
4.1 KiB
7 years ago
|
Subject: [PATCH 2/2] lost_reset: return value rather than sequence number when zero
|
||
|
|
Date: Wed, 22 Nov 2017 19:00:57 -0500
|
||
|
|
|
||
|
|
The kernel always returns negative values on error, so zero and anything
|
||
|
|
positive is valid success. Lost_reset returned a positive value at the
|
||
|
|
time of reset, including zero that got interpreted as success and
|
||
|
|
replaced with the packet sequence number "2".
|
||
|
|
|
||
|
|
Rename audit_send() to __audit_send() and pass the sequence number back
|
||
|
|
via a parameter rather than return value.
|
||
|
|
|
||
|
|
Have a new stub audit_send() call __audit_send() and mimic the previous
|
||
|
|
behaviour of audit_send().
|
||
|
|
|
||
|
|
There are legacy functions that actually use a sequence number:
|
||
|
|
audit_request_rules_list_data()
|
||
|
|
delete_all_rules()
|
||
|
|
audit_request_signal_info()
|
||
|
|
src/auditd.c:get_reply()
|
||
|
|
A number of others don't appear to need it, but expose it in libaudit:
|
||
|
|
audit_send_user_message()
|
||
|
|
audit_log_user_comm_message()
|
||
|
|
audit_log_acct_message()
|
||
|
|
audit_log_user_avc_message()
|
||
|
|
audit_log_semanage_message()
|
||
|
|
audit_log_user_command()
|
||
|
|
audit_request_status()
|
||
|
|
audit_set_enabled()
|
||
|
|
audit_set_failure()
|
||
|
|
audit_set_rate_limit()
|
||
|
|
audit_set_backlog_limit()
|
||
|
|
audit_set_backlog_wait_time()
|
||
|
|
audit_add_rule_data()
|
||
|
|
audit_delete_rule_data()
|
||
|
|
|
||
|
|
Passes all audit-testsuite tests.
|
||
|
|
|
||
|
|
See: https://github.com/linux-audit/audit-userspace/issues/31
|
||
|
|
|
||
|
|
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
|
||
|
|
---
|
||
|
|
lib/libaudit.c | 3 ++-
|
||
|
|
lib/netlink.c | 28 ++++++++++++++++++++--------
|
||
|
|
lib/private.h | 1 +
|
||
|
|
3 files changed, 23 insertions(+), 9 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/lib/libaudit.c b/lib/libaudit.c
|
||
|
|
index a9ba575..aa8258c 100644
|
||
|
|
--- a/lib/libaudit.c
|
||
|
|
+++ b/lib/libaudit.c
|
||
|
|
@@ -519,6 +519,7 @@ int audit_set_backlog_wait_time(int fd, uint32_t bwt)
|
||
|
|
int audit_reset_lost(int fd)
|
||
|
|
{
|
||
|
|
int rc;
|
||
|
|
+ int seq;
|
||
|
|
struct audit_status s;
|
||
|
|
|
||
|
|
if ((audit_get_features() & AUDIT_FEATURE_BITMAP_LOST_RESET) == 0)
|
||
|
|
@@ -527,7 +528,7 @@ int audit_reset_lost(int fd)
|
||
|
|
memset(&s, 0, sizeof(s));
|
||
|
|
s.mask = AUDIT_STATUS_LOST;
|
||
|
|
s.lost = 0;
|
||
|
|
- rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));
|
||
|
|
+ rc = __audit_send(fd, AUDIT_SET, &s, sizeof(s), &seq);
|
||
|
|
if (rc < 0)
|
||
|
|
audit_msg(audit_priority(errno),
|
||
|
|
"Error sending lost reset request (%s)",
|
||
|
|
diff --git a/lib/netlink.c b/lib/netlink.c
|
||
|
|
index 6e23883..5b2028f 100644
|
||
|
|
--- a/lib/netlink.c
|
||
|
|
+++ b/lib/netlink.c
|
||
|
|
@@ -203,7 +203,7 @@ static int adjust_reply(struct audit_reply *rep, int len)
|
||
|
|
* error: -errno
|
||
|
|
* short: 0
|
||
|
|
*/
|
||
|
|
-int audit_send(int fd, int type, const void *data, unsigned int size)
|
||
|
|
+int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq)
|
||
|
|
{
|
||
|
|
static int sequence = 0;
|
||
|
|
struct audit_message req;
|
||
|
|
@@ -224,6 +224,7 @@ int audit_send(int fd, int type, const void *data, unsigned int size)
|
||
|
|
|
||
|
|
if (++sequence < 0)
|
||
|
|
sequence = 1;
|
||
|
|
+ *seq = sequence;
|
||
|
|
|
||
|
|
memset(&req, 0, sizeof(req));
|
||
|
|
req.nlh.nlmsg_len = NLMSG_SPACE(size);
|
||
|
|
@@ -241,18 +242,29 @@ int audit_send(int fd, int type, const void *data, unsigned int size)
|
||
|
|
retval = sendto(fd, &req, req.nlh.nlmsg_len, 0,
|
||
|
|
(struct sockaddr*)&addr, sizeof(addr));
|
||
|
|
} while (retval < 0 && errno == EINTR);
|
||
|
|
- if (retval == (int)req.nlh.nlmsg_len) {
|
||
|
|
- if ((retval = check_ack(fd)) == 0)
|
||
|
|
- return sequence;
|
||
|
|
- else
|
||
|
|
- return retval;
|
||
|
|
- }
|
||
|
|
- if (retval < 0)
|
||
|
|
+ if (retval == (int)req.nlh.nlmsg_len)
|
||
|
|
+ return check_ack(fd);
|
||
|
|
+ if (retval < 0) {
|
||
|
|
return -errno;
|
||
|
|
+ } else if (retval > 0) {
|
||
|
|
+ errno = EINVAL;
|
||
|
|
+ return -errno;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+int audit_send(int fd, int type, const void *data, unsigned int size)
|
||
|
|
+{
|
||
|
|
+ int rc;
|
||
|
|
+ int seq;
|
||
|
|
+
|
||
|
|
+ rc = __audit_send(fd, type, data, size, &seq);
|
||
|
|
+ if (rc == 0)
|
||
|
|
+ rc = seq;
|
||
|
|
+ return rc;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* This function will take a peek into the next packet and see if there's
|
||
|
|
* an error. If so, the error is returned and its non-zero. Otherwise a
|
||
|
|
diff --git a/lib/private.h b/lib/private.h
|
||
|
|
index dbe0f74..560740f 100644
|
||
|
|
--- a/lib/private.h
|
||
|
|
+++ b/lib/private.h
|
||
|
|
@@ -121,6 +121,7 @@ void audit_msg(int priority, const char *fmt, ...)
|
||
|
|
#endif
|
||
|
|
|
||
|
|
extern int audit_send(int fd, int type, const void *data, unsigned int size);
|
||
|
|
+extern int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq);
|
||
|
|
|
||
|
|
AUDIT_HIDDEN_START
|
||
|
|
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|
||
|
|
|