[PATCH] fix broken timestamps in AVC generated by kernel threads

Timestamp in audit_context is valid only if ->in_syscall is set.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 1b2a6a5c18767fd58d2e13428dbaaecd4748dd33..8f0672d13eb1bf8bbddba0d30c6ecdfd30c94ddf 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -435,7 +435,7 @@ static inline void audit_ptrace(struct task_struct *t)
 
                                /* Private API (for audit.c only) */
 extern unsigned int audit_serial(void);
-extern void auditsc_get_stamp(struct audit_context *ctx,
+extern int auditsc_get_stamp(struct audit_context *ctx,
                              struct timespec *t, unsigned int *serial);
 extern int  audit_set_loginuid(struct task_struct *task, uid_t loginuid);
 #define audit_get_loginuid(t) ((t)->loginuid)
@@ -518,7 +518,7 @@ extern int audit_signals;
 #define audit_inode(n,d) do { ; } while (0)
 #define audit_inode_child(d,i,p) do { ; } while (0)
 #define audit_core_dumps(i) do { ; } while (0)
-#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
+#define auditsc_get_stamp(c,t,s) (0)
 #define audit_get_loginuid(t) (-1)
 #define audit_get_sessionid(t) (-1)
 #define audit_log_task_context(b) do { ; } while (0)

diff --git a/kernel/audit.c b/kernel/audit.c
index d8646c23b427ecd122a73894f6f72535bfd01585..ce6d8ea3131e78136b3b50803c424c0fffbeb20a 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1121,9 +1121,7 @@ unsigned int audit_serial(void)
 static inline void audit_get_stamp(struct audit_context *ctx,
                                   struct timespec *t, unsigned int *serial)
 {
-       if (ctx)
-               auditsc_get_stamp(ctx, t, serial);
-       else {
+       if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
                *t = CURRENT_TIME;
                *serial = audit_serial();
        }

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 0a13d6895494838953fe168eb4ca02f1e2f965ba..2a3f0afc4d2ac191835c39988506dfd84d1e4737 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1957,15 +1957,18 @@ EXPORT_SYMBOL_GPL(__audit_inode_child);
  *
  * Also sets the context as auditable.
  */
-void auditsc_get_stamp(struct audit_context *ctx,
+int auditsc_get_stamp(struct audit_context *ctx,
                       struct timespec *t, unsigned int *serial)
 {
+       if (!ctx->in_syscall)
+               return 0;
        if (!ctx->serial)
                ctx->serial = audit_serial();
        t->tv_sec  = ctx->ctime.tv_sec;
        t->tv_nsec = ctx->ctime.tv_nsec;
        *serial    = ctx->serial;
        ctx->auditable = 1;
+       return 1;
 }
 
 /* global counter which is incremented every time something logs in */