mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-10-31 16:48:26 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

audit: fix suffixed '/' filename matching

Browse source 
When the user specifies a directory to delete with the suffix '/',
the audit record fails to collect the filename, resulting in the
following logs:

 type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=2 name=(null)
 type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=1 name=(null)

It happens because the value of the variables dname, and n->name->name
in __audit_inode_child() differ only by the suffix '/'. This commit
treats this corner case by handling pathname's trailing slashes in
audit_compare_dname_path().

Steps to reproduce the issue:

 # auditctl -w /tmp
 $ mkdir /tmp/foo
 $ rm -r /tmp/foo/
 # ausearch -i | grep PATH | tail -3

The first version of this patch was based on a GitHub patch/PR by
user @hqh2010 [1].

Link: https://github.com/linux-audit/audit-kernel/pull/148 [1]

Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: subject tweak, trim old metadata]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ricardo Robaina 2024-11-22 09:18:43 -03:00 committed by Paul Moore
parent 40384c840e
commit e92eebb0d6
1 changed files with 11 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

15
kernel/auditfilter.c
View file

@ -1319,13 +1319,20 @@ int audit_compare_dname_path(const struct qstr *dname, const char *path, int par
if (pathlen < dlen) if (pathlen < dlen)
return 1; return 1;
parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; if (parentlen == AUDIT_NAME_FULL)
if (pathlen - parentlen != dlen) parentlen = parent_len(path);
return 1;
p = path + parentlen; p = path + parentlen;
return strncmp(p, dname->name, dlen); /* handle trailing slashes */
pathlen -= parentlen;
while (p[pathlen - 1] == '/')
pathlen--;
if (pathlen != dlen)
return 1;
return memcmp(p, dname->name, dlen);
} }
int audit_filter(int msgtype, unsigned int listtype) int audit_filter(int msgtype, unsigned int listtype)