From: Richard Guy Briggs <rgb@redhat.com>
Date: Fri, 15 Nov 2013 16:29:02 +0000 (-0500)
Subject: audit: log AUDIT_TTY_SET config changes
X-Git-Tag: firefly_0821_release~176^2~4072^2~57
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=a06e56b2a11b5f7d5354b05988f97118c90580d2;p=firefly-linux-kernel-4.4.55.git

audit: log AUDIT_TTY_SET config changes

Log transition of config changes when AUDIT_TTY_SET is called, including both
enabled and log_passwd values now in the struct.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

diff --git a/kernel/audit.c b/kernel/audit.c
index 2dc757354693..fdb8528ceca3 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -989,20 +989,38 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 		break;
 	}
 	case AUDIT_TTY_SET: {
-		struct audit_tty_status s;
+		struct audit_tty_status s, old;
 		struct task_struct *tsk = current;
+		struct audit_buffer	*ab;
+		int res = 0;
+
+		spin_lock(&tsk->sighand->siglock);
+		old.enabled = tsk->signal->audit_tty;
+		old.log_passwd = tsk->signal->audit_tty_log_passwd;
+		spin_unlock(&tsk->sighand->siglock);
 
 		memset(&s, 0, sizeof(s));
 		/* guard against past and future API changes */
 		memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
-		if ((s.enabled != 0 && s.enabled != 1) ||
-		    (s.log_passwd != 0 && s.log_passwd != 1))
+		if ((s.enabled == 0 || s.enabled == 1) &&
+		    (s.log_passwd == 0 || s.log_passwd == 1))
+			res = 1;
+		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
+		audit_log_format(ab, " op=tty_set"
+				 " old-enabled=%d old-log_passwd=%d"
+				 " new-enabled=%d new-log_passwd=%d"
+				 " res=%d",
+				 old.enabled, old.log_passwd,
+				 s.enabled, s.log_passwd,
+				 res);
+		audit_log_end(ab);
+		if (res) {
+			spin_lock(&tsk->sighand->siglock);
+			tsk->signal->audit_tty = s.enabled;
+			tsk->signal->audit_tty_log_passwd = s.log_passwd;
+			spin_unlock(&tsk->sighand->siglock);
+		} else
 			return -EINVAL;
-
-		spin_lock(&tsk->sighand->siglock);
-		tsk->signal->audit_tty = s.enabled;
-		tsk->signal->audit_tty_log_passwd = s.log_passwd;
-		spin_unlock(&tsk->sighand->siglock);
 		break;
 	}
 	default: