UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM

[mirror_ubuntu-hirsute-kernel.git] / kernel / audit.c

diff --git a/kernel/audit.c b/kernel/audit.c
index f8467f00579157f9d252a3bc3e4635956b5444b3..de69f2ab20224965ca827e30176ac97f5222a1f7 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2196,6 +2196,59 @@ int audit_log_task_context(struct audit_buffer *ab, struct lsmblob *blob)
 }
 EXPORT_SYMBOL(audit_log_task_context);
 
+int audit_log_object_context(struct audit_buffer *ab,
+                                   struct lsmblob *blob)
+{
+       int i;
+       int error;
+       bool sep = false;
+       struct lsmcontext lsmdata;
+       struct audit_buffer *lsmab = NULL;
+       struct audit_context *context = NULL;
+
+       /*
+        * If there is more than one security module that has a
+        * object "context" it's necessary to put the object data
+        * into a separate record to maintain compatibility.
+        */
+       if (lsm_multiple_contexts()) {
+               audit_log_format(ab, " obj=?");
+               context = ab->ctx;
+               if (context)
+                       lsmab = audit_log_start(context, GFP_KERNEL,
+                                               AUDIT_MAC_OBJ_CONTEXTS);
+       }
+
+       for (i = 0; i < LSMBLOB_ENTRIES; i++) {
+               if (blob->secid[i] == 0)
+                       continue;
+               error = security_secid_to_secctx(blob, &lsmdata, i);
+               if (error && error != -EINVAL) {
+                       audit_panic("error in audit_log_object_context");
+                       return error;
+               }
+
+               if (context) {
+                       audit_log_format(lsmab, "%sobj_%s=%s",
+                                        sep ? " " : "",
+                                        security_lsm_slot_name(i),
+                                        lsmdata.context);
+                       sep = true;
+               } else
+                       audit_log_format(ab, " obj=%s", lsmdata.context);
+
+               security_release_secctx(&lsmdata);
+               if (!context)
+                       break;
+       }
+
+       if (context)
+               audit_log_end(lsmab);
+
+       return 0;
+}
+EXPORT_SYMBOL(audit_log_object_context);
+
 void audit_log_d_path_exe(struct audit_buffer *ab,
                          struct mm_struct *mm)
 {