audit_match_signal() and friends are used only if CONFIG_AUDITSYSCALL is set

[firefly-linux-kernel-4.4.55.git] / kernel / auditsc.c

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 5276b7ef05f1c212a575677b391b080859238584..e36481ed61b4d0b138fa43e7662c0b65cfb021a5 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2037,3 +2037,42 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
        return 0;
 }
+
+/**
+ * audit_core_dumps - record information about processes that end abnormally
+ * @sig: signal value
+ *
+ * If a process ends with a core dump, something fishy is going on and we
+ * should record the event for investigation.
+ */
+void audit_core_dumps(long signr)
+{
+       struct audit_buffer *ab;
+       u32 sid;
+
+       if (!audit_enabled)
+               return;
+
+       if (signr == SIGQUIT)   /* don't care for those */
+               return;
+
+       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
+       audit_log_format(ab, "auid=%u uid=%u gid=%u",
+                       audit_get_loginuid(current->audit_context),
+                       current->uid, current->gid);
+       selinux_get_task_sid(current, &sid);
+       if (sid) {
+               char *ctx = NULL;
+               u32 len;
+
+               if (selinux_sid_to_string(sid, &ctx, &len))
+                       audit_log_format(ab, " ssid=%u", sid);
+               else
+                       audit_log_format(ab, " subj=%s", ctx);
+               kfree(ctx);
+       }
+       audit_log_format(ab, " pid=%d comm=", current->pid);
+       audit_log_untrustedstring(ab, current->comm);
+       audit_log_format(ab, " sig=%ld", signr);
+       audit_log_end(ab);
+}