summaryrefslogtreecommitdiffstats
path: root/kernel/audit.c
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2014-03-15 18:42:34 -0400
committerEric Paris <eparis@redhat.com>2014-09-23 16:37:56 -0400
commit9eab339b197a6903043d272295dcb716ff739b21 (patch)
tree4f8c204a04b59bc20e679f84f1d6b28f79fcce2c /kernel/audit.c
parentf874738e8c178b19479f7b143211a1df00367988 (diff)
downloadlinux-9eab339b197a6903043d272295dcb716ff739b21.tar.gz
linux-9eab339b197a6903043d272295dcb716ff739b21.tar.bz2
linux-9eab339b197a6903043d272295dcb716ff739b21.zip
audit: get comm using lock to avoid race in string printing
When task->comm is passed directly to audit_log_untrustedstring() without getting a copy or using the task_lock, there is a race that could happen that would output a NULL (\0) in the output string that would effectively truncate the rest of the report text after the comm= field in the audit, losing fields. Use get_task_comm() to get a copy while acquiring the task_lock to prevent this and to prevent the result from being a mixture of old and new values of comm. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Diffstat (limited to 'kernel/audit.c')
-rw-r--r--kernel/audit.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 3a80abb6eaa1..53bb39bf79e2 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1850,7 +1850,7 @@ EXPORT_SYMBOL(audit_log_task_context);
void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
{
const struct cred *cred;
- char name[sizeof(tsk->comm)];
+ char comm[sizeof(tsk->comm)];
struct mm_struct *mm = tsk->mm;
char *tty;
@@ -1884,9 +1884,8 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
from_kgid(&init_user_ns, cred->fsgid),
tty, audit_get_sessionid(tsk));
- get_task_comm(name, tsk);
audit_log_format(ab, " comm=");
- audit_log_untrustedstring(ab, name);
+ audit_log_untrustedstring(ab, get_task_comm(comm, tsk));
if (mm) {
down_read(&mm->mmap_sem);