blackfin: use kbuild.h instead of defining macros in asm-macros.c

[linux-2.6-omap-h63xx.git] / kernel / audit.c

diff --git a/kernel/audit.c b/kernel/audit.c
index 10c4930c2bbfbe0e98a5b56ff61a953fd4017367..a7b16086d36f7b863a19697eed4877b67226b197 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -21,7 +21,7 @@
  *
  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
  *
- * Goals: 1) Integrate fully with SELinux.
+ * Goals: 1) Integrate fully with Security Modules.
  *       2) Minimal run-time overhead:
  *          a) Minimal when syscall auditing is disabled (audit_enable=0).
  *          b) Small when syscall auditing is enabled and no audit record
@@ -55,7 +55,6 @@
 #include <net/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
-#include <linux/selinux.h>
 #include <linux/inotify.h>
 #include <linux/freezer.h>
 #include <linux/tty.h>
@@ -78,9 +77,13 @@ static int   audit_default;
 /* If auditing cannot proceed, audit_failure selects what happens. */
 static int     audit_failure = AUDIT_FAIL_PRINTK;
 
-/* If audit records are to be written to the netlink socket, audit_pid
- * contains the (non-zero) pid. */
+/*
+ * If audit records are to be written to the netlink socket, audit_pid
+ * contains the pid of the auditd process and audit_nlk_pid contains
+ * the pid to use to send netlink messages to that process.
+ */
 int            audit_pid;
+static int     audit_nlk_pid;
 
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -261,13 +264,13 @@ static int audit_log_config_change(char *function_name, int new, int old,
                char *ctx = NULL;
                u32 len;
 
-               rc = selinux_sid_to_string(sid, &ctx, &len);
+               rc = security_secid_to_secctx(sid, &ctx, &len);
                if (rc) {
                        audit_log_format(ab, " sid=%u", sid);
                        allow_changes = 0; /* Something weird, deny request */
                } else {
                        audit_log_format(ab, " subj=%s", ctx);
-                       kfree(ctx);
+                       security_release_secctx(ctx, len);
                }
        }
        audit_log_format(ab, " res=%d", allow_changes);
@@ -350,7 +353,7 @@ static int kauditd_thread(void *dummy)
                wake_up(&audit_backlog_wait);
                if (skb) {
                        if (audit_pid) {
-                               int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
+                               int err = netlink_unicast(audit_sock, skb, audit_nlk_pid, 0);
                                if (err < 0) {
                                        BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
                                        printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
@@ -546,12 +549,13 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
        audit_log_format(*ab, "user pid=%d uid=%u auid=%u",
                         pid, uid, auid);
        if (sid) {
-               rc = selinux_sid_to_string(sid, &ctx, &len);
+               rc = security_secid_to_secctx(sid, &ctx, &len);
                if (rc)
                        audit_log_format(*ab, " ssid=%u", sid);
-               else
+               else {
                        audit_log_format(*ab, " subj=%s", ctx);
-               kfree(ctx);
+                       security_release_secctx(ctx, len);
+               }
        }
 
        return rc;
@@ -626,6 +630,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                        sid, 1);
 
                        audit_pid = new_pid;
+                       audit_nlk_pid = NETLINK_CB(skb).pid;
                }
                if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
                        err = audit_set_rate_limit(status_get->rate_limit,
@@ -753,18 +758,18 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                break;
        }
        case AUDIT_SIGNAL_INFO:
-               err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
+               err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
                if (err)
                        return err;
                sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
                if (!sig_data) {
-                       kfree(ctx);
+                       security_release_secctx(ctx, len);
                        return -ENOMEM;
                }
                sig_data->uid = audit_sig_uid;
                sig_data->pid = audit_sig_pid;
                memcpy(sig_data->ctx, ctx, len);
-               kfree(ctx);
+               security_release_secctx(ctx, len);
                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
                                0, 0, sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
@@ -876,10 +881,6 @@ static int __init audit_init(void)
        audit_enabled = audit_default;
        audit_ever_enabled |= !!audit_default;
 
-       /* Register the callback with selinux.  This callback will be invoked
-        * when a new policy is loaded. */
-       selinux_audit_set_callback(&selinux_audit_rule_update);
-
        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
 
 #ifdef CONFIG_AUDITSYSCALL
@@ -1264,8 +1265,8 @@ static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
 
 /**
  * audit_string_contains_control - does a string need to be logged in hex
- * @string - string to be checked
- * @len - max length of the string to check
+ * @string: string to be checked
+ * @len: max length of the string to check
  */
 int audit_string_contains_control(const char *string, size_t len)
 {
@@ -1280,7 +1281,7 @@ int audit_string_contains_control(const char *string, size_t len)
 /**
  * audit_log_n_untrustedstring - log a string that may contain random characters
  * @ab: audit_buffer
- * @len: lenth of string (not including trailing null)
+ * @len: length of string (not including trailing null)
  * @string: string to be logged
  *
  * This code will escape a string that is passed to it if the string