On 16/06/03, Paul Moore wrote:
> On Wed, Jun 1, 2016 at 6:50 PM, Richard Guy Briggs <r...@redhat.com> wrote:
> > RFE: add additional fields for use in audit filter exclude rules
> > https://github.com/linux-audit/audit-kernel/issues/5
> >
> > Re-factor audit_filter_type() to use audit_filter_user_rules() to enable
> > exclude filter to additionally filter on PID, UID, GID, AUID,
> > LOGINUID_SET, SUBJ_*.
> >
> > Add check in audit_filter_user() to quit early if list is empty.
> >
> > Signed-off-by: Richard Guy Briggs <r...@redhat.com>
> > ---
> > kernel/auditfilter.c | 22 +++++++++-------------
> > 1 files changed, 9 insertions(+), 13 deletions(-)
>
> I like the consolidation between audit_filter_type() and
> audit_filter_user(), I like it so much I think we should take it
> further. Let's consolidate both functions into a single function (say
> audit_filter()?) and update the callers to use the new function. This
> shouldn't be hard as the only callers are audit_receive_msg() and
> audit_log_start(); you'll need to be careful as the return values of
> the current functions are opposite of each other, but it should be
> easy enough to update one of the callers.
>
> Sound reasonable?
Potentially... I was even eyeing kernel/auditsc.c::audit_filter_rules()
for re-factoring...
> > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> > index 96c9a1b..515c752 100644
> > --- a/kernel/auditfilter.c
> > +++ b/kernel/auditfilter.c
> > @@ -1358,6 +1358,9 @@ int audit_filter_user(int type)
> > ret = 1; /* Audit by default */
> >
> > rcu_read_lock();
> > + if (list_empty(&audit_filter_list[AUDIT_FILTER_USER]))
> > + goto unlock_and_return;
> > +
> > list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER],
> > list) {
> > rc = audit_filter_user_rules(&e->rule, type, &state);
> > if (rc) {
> > @@ -1366,13 +1369,14 @@ int audit_filter_user(int type)
> > break;
> > }
> > }
> > +unlock_and_return:
> > rcu_read_unlock();
> > -
> > return ret;
> > }
> >
> > int audit_filter_type(int type)
> > {
> > + enum audit_state state = AUDIT_DISABLED;
> > struct audit_entry *e;
> > int result = 0;
> >
> > @@ -1380,19 +1384,11 @@ int audit_filter_type(int type)
> > if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
> > goto unlock_and_return;
> >
> > - list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
> > - list) {
> > - int i;
> > - for (i = 0; i < e->rule.field_count; i++) {
> > - struct audit_field *f = &e->rule.fields[i];
> > - if (f->type == AUDIT_MSGTYPE) {
> > - result = audit_comparator(type, f->op,
> > f->val);
> > - if (!result)
> > - break;
> > - }
> > + list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
> > list) {
> > + if (audit_filter_user_rules(&e->rule, type, &state) == 1) {
> > + result = 1;
> > + break;
> > }
> > - if (result)
> > - goto unlock_and_return;
> > }
> > unlock_and_return:
> > rcu_read_unlock();
> > --
> > 1.7.1
> >
> > --
> > Linux-audit mailing list
> > linux-au...@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
>
>
>
> --
> paul moore
> www.paul-moore.com
- RGB
--
Richard Guy Briggs <r...@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
