You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
141 lines
4.1 KiB
141 lines
4.1 KiB
Subject: [PATCH 2/2] lost_reset: return value rather than sequence number when zero |
|
Date: Wed, 22 Nov 2017 19:00:57 -0500 |
|
|
|
The kernel always returns negative values on error, so zero and anything |
|
positive is valid success. Lost_reset returned a positive value at the |
|
time of reset, including zero that got interpreted as success and |
|
replaced with the packet sequence number "2". |
|
|
|
Rename audit_send() to __audit_send() and pass the sequence number back |
|
via a parameter rather than return value. |
|
|
|
Have a new stub audit_send() call __audit_send() and mimic the previous |
|
behaviour of audit_send(). |
|
|
|
There are legacy functions that actually use a sequence number: |
|
audit_request_rules_list_data() |
|
delete_all_rules() |
|
audit_request_signal_info() |
|
src/auditd.c:get_reply() |
|
A number of others don't appear to need it, but expose it in libaudit: |
|
audit_send_user_message() |
|
audit_log_user_comm_message() |
|
audit_log_acct_message() |
|
audit_log_user_avc_message() |
|
audit_log_semanage_message() |
|
audit_log_user_command() |
|
audit_request_status() |
|
audit_set_enabled() |
|
audit_set_failure() |
|
audit_set_rate_limit() |
|
audit_set_backlog_limit() |
|
audit_set_backlog_wait_time() |
|
audit_add_rule_data() |
|
audit_delete_rule_data() |
|
|
|
Passes all audit-testsuite tests. |
|
|
|
See: https://github.com/linux-audit/audit-userspace/issues/31 |
|
|
|
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> |
|
--- |
|
lib/libaudit.c | 3 ++- |
|
lib/netlink.c | 28 ++++++++++++++++++++-------- |
|
lib/private.h | 1 + |
|
3 files changed, 23 insertions(+), 9 deletions(-) |
|
|
|
diff --git a/lib/libaudit.c b/lib/libaudit.c |
|
index a9ba575..aa8258c 100644 |
|
--- a/lib/libaudit.c |
|
+++ b/lib/libaudit.c |
|
@@ -519,6 +519,7 @@ int audit_set_backlog_wait_time(int fd, uint32_t bwt) |
|
int audit_reset_lost(int fd) |
|
{ |
|
int rc; |
|
+ int seq; |
|
struct audit_status s; |
|
|
|
if ((audit_get_features() & AUDIT_FEATURE_BITMAP_LOST_RESET) == 0) |
|
@@ -527,7 +528,7 @@ int audit_reset_lost(int fd) |
|
memset(&s, 0, sizeof(s)); |
|
s.mask = AUDIT_STATUS_LOST; |
|
s.lost = 0; |
|
- rc = audit_send(fd, AUDIT_SET, &s, sizeof(s)); |
|
+ rc = __audit_send(fd, AUDIT_SET, &s, sizeof(s), &seq); |
|
if (rc < 0) |
|
audit_msg(audit_priority(errno), |
|
"Error sending lost reset request (%s)", |
|
diff --git a/lib/netlink.c b/lib/netlink.c |
|
index 6e23883..5b2028f 100644 |
|
--- a/lib/netlink.c |
|
+++ b/lib/netlink.c |
|
@@ -203,7 +203,7 @@ static int adjust_reply(struct audit_reply *rep, int len) |
|
* error: -errno |
|
* short: 0 |
|
*/ |
|
-int audit_send(int fd, int type, const void *data, unsigned int size) |
|
+int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq) |
|
{ |
|
static int sequence = 0; |
|
struct audit_message req; |
|
@@ -224,6 +224,7 @@ int audit_send(int fd, int type, const void *data, unsigned int size) |
|
|
|
if (++sequence < 0) |
|
sequence = 1; |
|
+ *seq = sequence; |
|
|
|
memset(&req, 0, sizeof(req)); |
|
req.nlh.nlmsg_len = NLMSG_SPACE(size); |
|
@@ -241,18 +242,29 @@ int audit_send(int fd, int type, const void *data, unsigned int size) |
|
retval = sendto(fd, &req, req.nlh.nlmsg_len, 0, |
|
(struct sockaddr*)&addr, sizeof(addr)); |
|
} while (retval < 0 && errno == EINTR); |
|
- if (retval == (int)req.nlh.nlmsg_len) { |
|
- if ((retval = check_ack(fd)) == 0) |
|
- return sequence; |
|
- else |
|
- return retval; |
|
- } |
|
- if (retval < 0) |
|
+ if (retval == (int)req.nlh.nlmsg_len) |
|
+ return check_ack(fd); |
|
+ if (retval < 0) { |
|
return -errno; |
|
+ } else if (retval > 0) { |
|
+ errno = EINVAL; |
|
+ return -errno; |
|
+ } |
|
|
|
return 0; |
|
} |
|
|
|
+int audit_send(int fd, int type, const void *data, unsigned int size) |
|
+{ |
|
+ int rc; |
|
+ int seq; |
|
+ |
|
+ rc = __audit_send(fd, type, data, size, &seq); |
|
+ if (rc == 0) |
|
+ rc = seq; |
|
+ return rc; |
|
+} |
|
+ |
|
/* |
|
* This function will take a peek into the next packet and see if there's |
|
* an error. If so, the error is returned and its non-zero. Otherwise a |
|
diff --git a/lib/private.h b/lib/private.h |
|
index dbe0f74..560740f 100644 |
|
--- a/lib/private.h |
|
+++ b/lib/private.h |
|
@@ -121,6 +121,7 @@ void audit_msg(int priority, const char *fmt, ...) |
|
#endif |
|
|
|
extern int audit_send(int fd, int type, const void *data, unsigned int size); |
|
+extern int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq); |
|
|
|
AUDIT_HIDDEN_START |
|
|
|
-- |
|
1.8.3.1 |
|
|
|
|
|
|