Skip to content

L
linux-davinci
Commit 3a6b9f85 authored by Darrel Goeddel's avatar Darrel Goeddel Committed by Al Viro
Browse files
Options

[PATCH] audit: rename AUDIT_SE_* constants 

This patch renames some audit constant definitions and adds
additional definitions used by the following patch.  The renaming
avoids ambiguity with respect to the new definitions.
Signed-off-by: default avatarDarrel Goeddel <dgoeddel@trustedcs.com>

 include/linux/audit.h          |   15 ++++++++----
 kernel/auditfilter.c           |   50 ++++++++++++++++++++---------------------
 kernel/auditsc.c               |   10 ++++----
 security/selinux/ss/services.c |   32 +++++++++++++-------------
 4 files changed, 56 insertions(+), 51 deletions(-)
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 5adc8a6a
Show whitespace changes
Inline Side-by-side
Showing with 56 additions and 51 deletions
include/linux/audit.h
View file @ 3a6b9f85
...@@ -151,12 +151,17 @@ ...@@ -151,12 +151,17 @@
#define AUDIT_PERS 10 #define AUDIT_PERS 10
#define AUDIT_ARCH 11 #define AUDIT_ARCH 11
#define AUDIT_MSGTYPE 12 #define AUDIT_MSGTYPE 12
#define AUDIT_SE_USER 13 /* security label user */ #define AUDIT_SUBJ_USER 13 /* security label user */
#define AUDIT_SE_ROLE 14 /* security label role */ #define AUDIT_SUBJ_ROLE 14 /* security label role */
#define AUDIT_SE_TYPE 15 /* security label type */ #define AUDIT_SUBJ_TYPE 15 /* security label type */
#define AUDIT_SE_SEN 16 /* security label sensitivity label */ #define AUDIT_SUBJ_SEN 16 /* security label sensitivity label */
#define AUDIT_SE_CLR 17 /* security label clearance label */ #define AUDIT_SUBJ_CLR 17 /* security label clearance label */
#define AUDIT_PPID 18 #define AUDIT_PPID 18
#define AUDIT_OBJ_USER 19
#define AUDIT_OBJ_ROLE 20
#define AUDIT_OBJ_TYPE 21
#define AUDIT_OBJ_LEV_LOW 22
#define AUDIT_OBJ_LEV_HIGH 23
/* These are ONLY useful when checking /* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */ * at syscall exit time (AUDIT_AT_EXIT). */
......
kernel/auditfilter.c
View file @ 3a6b9f85
...@@ -470,11 +470,11 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, ...@@ -470,11 +470,11 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
case AUDIT_ARG2: case AUDIT_ARG2:
case AUDIT_ARG3: case AUDIT_ARG3:
break; break;
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
str = audit_unpack_string(&bufp, &remain, f->val); str = audit_unpack_string(&bufp, &remain, f->val);
if (IS_ERR(str)) if (IS_ERR(str))
goto exit_free; goto exit_free;
...@@ -611,11 +611,11 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) ...@@ -611,11 +611,11 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
data->fields[i] = f->type; data->fields[i] = f->type;
data->fieldflags[i] = f->op; data->fieldflags[i] = f->op;
switch(f->type) { switch(f->type) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
data->buflen += data->values[i] = data->buflen += data->values[i] =
audit_pack_string(&bufp, f->se_str); audit_pack_string(&bufp, f->se_str);
break; break;
...@@ -654,11 +654,11 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) ...@@ -654,11 +654,11 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
return 1; return 1;
switch(a->fields[i].type) { switch(a->fields[i].type) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
if (strcmp(a->fields[i].se_str, b->fields[i].se_str)) if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
return 1; return 1;
break; break;
...@@ -774,11 +774,11 @@ static struct audit_entry *audit_dupe_rule(struct audit_krule *old, ...@@ -774,11 +774,11 @@ static struct audit_entry *audit_dupe_rule(struct audit_krule *old,
* the originals will all be freed when the old rule is freed. */ * the originals will all be freed when the old rule is freed. */
for (i = 0; i < fcount; i++) { for (i = 0; i < fcount; i++) {
switch (new->fields[i].type) { switch (new->fields[i].type) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
err = audit_dupe_selinux_field(&new->fields[i], err = audit_dupe_selinux_field(&new->fields[i],
&old->fields[i]); &old->fields[i]);
break; break;
...@@ -1537,11 +1537,11 @@ static inline int audit_rule_has_selinux(struct audit_krule *rule) ...@@ -1537,11 +1537,11 @@ static inline int audit_rule_has_selinux(struct audit_krule *rule)
for (i = 0; i < rule->field_count; i++) { for (i = 0; i < rule->field_count; i++) {
struct audit_field *f = &rule->fields[i]; struct audit_field *f = &rule->fields[i];
switch (f->type) { switch (f->type) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
return 1; return 1;
} }
} }
......
kernel/auditsc.c
View file @ 3a6b9f85
...@@ -321,11 +321,11 @@ static int audit_filter_rules(struct task_struct *tsk, ...@@ -321,11 +321,11 @@ static int audit_filter_rules(struct task_struct *tsk,
if (ctx) if (ctx)
result = audit_comparator(ctx->loginuid, f->op, f->val); result = audit_comparator(ctx->loginuid, f->op, f->val);
break; break;
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
/* NOTE: this may return negative values indicating /* NOTE: this may return negative values indicating
a temporary error. We simply treat this as a a temporary error. We simply treat this as a
match for now to avoid losing information that match for now to avoid losing information that
......
security/selinux/ss/services.c
View file @ 3a6b9f85
...@@ -1845,15 +1845,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, ...@@ -1845,15 +1845,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
return -ENOTSUPP; return -ENOTSUPP;
switch (field) { switch (field) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
/* only 'equals' and 'not equals' fit user, role, and type */ /* only 'equals' and 'not equals' fit user, role, and type */
if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL) if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)
return -EINVAL; return -EINVAL;
break; break;
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
/* we do not allow a range, indicated by the presense of '-' */ /* we do not allow a range, indicated by the presense of '-' */
if (strchr(rulestr, '-')) if (strchr(rulestr, '-'))
return -EINVAL; return -EINVAL;
...@@ -1874,29 +1874,29 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, ...@@ -1874,29 +1874,29 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
tmprule->au_seqno = latest_granting; tmprule->au_seqno = latest_granting;
switch (field) { switch (field) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
userdatum = hashtab_search(policydb.p_users.table, rulestr); userdatum = hashtab_search(policydb.p_users.table, rulestr);
if (!userdatum) if (!userdatum)
rc = -EINVAL; rc = -EINVAL;
else else
tmprule->au_ctxt.user = userdatum->value; tmprule->au_ctxt.user = userdatum->value;
break; break;
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
roledatum = hashtab_search(policydb.p_roles.table, rulestr); roledatum = hashtab_search(policydb.p_roles.table, rulestr);
if (!roledatum) if (!roledatum)
rc = -EINVAL; rc = -EINVAL;
else else
tmprule->au_ctxt.role = roledatum->value; tmprule->au_ctxt.role = roledatum->value;
break; break;
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
typedatum = hashtab_search(policydb.p_types.table, rulestr); typedatum = hashtab_search(policydb.p_types.table, rulestr);
if (!typedatum) if (!typedatum)
rc = -EINVAL; rc = -EINVAL;
else else
tmprule->au_ctxt.type = typedatum->value; tmprule->au_ctxt.type = typedatum->value;
break; break;
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
break; break;
} }
...@@ -1948,7 +1948,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, ...@@ -1948,7 +1948,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
/* a field/op pair that is not caught here will simply fall through /* a field/op pair that is not caught here will simply fall through
without a match */ without a match */
switch (field) { switch (field) {
case AUDIT_SE_USER: case AUDIT_SUBJ_USER:
switch (op) { switch (op) {
case AUDIT_EQUAL: case AUDIT_EQUAL:
match = (ctxt->user == rule->au_ctxt.user); match = (ctxt->user == rule->au_ctxt.user);
...@@ -1958,7 +1958,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, ...@@ -1958,7 +1958,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break; break;
} }
break; break;
case AUDIT_SE_ROLE: case AUDIT_SUBJ_ROLE:
switch (op) { switch (op) {
case AUDIT_EQUAL: case AUDIT_EQUAL:
match = (ctxt->role == rule->au_ctxt.role); match = (ctxt->role == rule->au_ctxt.role);
...@@ -1968,7 +1968,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, ...@@ -1968,7 +1968,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break; break;
} }
break; break;
case AUDIT_SE_TYPE: case AUDIT_SUBJ_TYPE:
switch (op) { switch (op) {
case AUDIT_EQUAL: case AUDIT_EQUAL:
match = (ctxt->type == rule->au_ctxt.type); match = (ctxt->type == rule->au_ctxt.type);
...@@ -1978,9 +1978,9 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, ...@@ -1978,9 +1978,9 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break; break;
} }
break; break;
case AUDIT_SE_SEN: case AUDIT_SUBJ_SEN:
case AUDIT_SE_CLR: case AUDIT_SUBJ_CLR:
level = (field == AUDIT_SE_SEN ? level = (field == AUDIT_SUBJ_SEN ?
&ctxt->range.level[0] : &ctxt->range.level[1]); &ctxt->range.level[0] : &ctxt->range.level[1]);
switch (op) { switch (op) {
case AUDIT_EQUAL: case AUDIT_EQUAL:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment