diff options
| author | Eric Paris <eparis@redhat.com> | 2012-01-03 14:23:08 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2012-01-17 16:17:02 -0500 |
| commit | c9fe685f7a17a0ee8bf3fbe51e40b1c8b8e65896 (patch) | |
| tree | 510a09bc02c5dccb7ef83c88f2a00546b17e2c17 | |
| parent | b34b039324bf081554ee8678f9b8c5d937e5206c (diff) | |
| download | linux-c9fe685f7a17a0ee8bf3fbe51e40b1c8b8e65896.tar.gz linux-c9fe685f7a17a0ee8bf3fbe51e40b1c8b8e65896.tar.bz2 linux-c9fe685f7a17a0ee8bf3fbe51e40b1c8b8e65896.zip | |
audit: allow interfield comparison between gid and ogid
Allow audit rules to compare the gid of the running task to the gid of the
inode in question.
Signed-off-by: Eric Paris <eparis@redhat.com>
| -rw-r--r-- | include/linux/audit.h | 3 | ||||
| -rw-r--r-- | kernel/auditsc.c | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index 838e05fc0582..fffbc2176ee1 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -184,8 +184,9 @@ /* AUDIT_FIELD_COMPARE rule list */ #define AUDIT_COMPARE_UID_TO_OBJ_UID 1 +#define AUDIT_COMPARE_GID_TO_OBJ_GID 2 -#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_UID_TO_OBJ_UID +#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_GID_TO_OBJ_GID /* Rule fields */ /* These are useful when checking the * task structure at task creation time diff --git a/kernel/auditsc.c b/kernel/auditsc.c index b12cc32fe377..861c7b9c565a 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -474,6 +474,8 @@ static int audit_compare_id(uid_t uid1, uid_t uid2; int rc; + BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t)); + if (name) { addr = (unsigned long)name; addr += name_offset; @@ -510,6 +512,10 @@ static int audit_field_compare(struct task_struct *tsk, return audit_compare_id(cred->uid, name, offsetof(struct audit_names, uid), f, ctx); + case AUDIT_COMPARE_GID_TO_OBJ_GID: + return audit_compare_id(cred->gid, + name, offsetof(struct audit_names, gid), + f, ctx); default: WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n"); return 0; |