audit: allow interfield comparison between gid and ogid
authorEric Paris <eparis@redhat.com>
Tue, 3 Jan 2012 19:23:08 +0000 (14:23 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 17 Jan 2012 21:17:02 +0000 (16:17 -0500)
Allow audit rules to compare the gid of the running task to the gid of the
inode in question.

Signed-off-by: Eric Paris <eparis@redhat.com>
include/linux/audit.h
kernel/auditsc.c

index 838e05fc05828ff1be340ee35801e9791aafae65..fffbc2176ee152fd4a9d282bad5ab997f1ada3b8 100644 (file)
 
 /* AUDIT_FIELD_COMPARE rule list */
 #define AUDIT_COMPARE_UID_TO_OBJ_UID   1
+#define AUDIT_COMPARE_GID_TO_OBJ_GID   2
 
-#define AUDIT_MAX_FIELD_COMPARE        AUDIT_COMPARE_UID_TO_OBJ_UID
+#define AUDIT_MAX_FIELD_COMPARE        AUDIT_COMPARE_GID_TO_OBJ_GID
 /* Rule fields */
                                /* These are useful when checking the
                                 * task structure at task creation time
index b12cc32fe37770c5a5c3536a8bb8e272c1343a8d..861c7b9c565ac1e8815128d7d809ac69127d2222 100644 (file)
@@ -474,6 +474,8 @@ static int audit_compare_id(uid_t uid1,
        uid_t uid2;
        int rc;
 
+       BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t));
+
        if (name) {
                addr = (unsigned long)name;
                addr += name_offset;
@@ -510,6 +512,10 @@ static int audit_field_compare(struct task_struct *tsk,
                return audit_compare_id(cred->uid,
                                        name, offsetof(struct audit_names, uid),
                                        f, ctx);
+       case AUDIT_COMPARE_GID_TO_OBJ_GID:
+               return audit_compare_id(cred->gid,
+                                       name, offsetof(struct audit_names, gid),
+                                       f, ctx);
        default:
                WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
                return 0;