summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2013-08-16 00:04:46 -0400
committerEric Paris <eparis@redhat.com>2014-03-20 10:11:56 -0400
commit5a3cb3b6c3a07904bb66baf055b2eaf01198b1f9 (patch)
treea6c8ab18c24ac035da29ef7b7cbc291cf864a451
parentf1dc4867ff41b7bcca57fa19449d1fe7ad517ac1 (diff)
audit: allow user processes to log from another PID namespace
Still only permit the audit logging daemon and control to operate from the initial PID namespace, but allow processes to log from another PID namespace. Cc: "Eric W. Biederman" <ebiederm@xmission.com> (informed by ebiederman's c776b5d2) Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
-rw-r--r--kernel/audit.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 5a096f8e28cb..72c6e1cd6ef5 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -607,9 +607,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
{
int err = 0;
- /* Only support the initial namespaces for now. */
- if ((current_user_ns() != &init_user_ns) ||
- (task_active_pid_ns(current) != &init_pid_ns))
+ /* Only support initial user namespace for now. */
+ if ((current_user_ns() != &init_user_ns))
return -EPERM;
switch (msg_type) {
@@ -629,6 +628,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
case AUDIT_TTY_SET:
case AUDIT_TRIM:
case AUDIT_MAKE_EQUIV:
+ /* Only support auditd and auditctl in initial pid namespace
+ * for now. */
+ if ((task_active_pid_ns(current) != &init_pid_ns))
+ return -EPERM;
+
if (!capable(CAP_AUDIT_CONTROL))
err = -EPERM;
break;