• Paul Moore's avatar
    audit: don't attempt to lookup PIDs when changing PID filtering audit rules · 3640dcfa
    Paul Moore authored
    Commit f1dc4867 ("audit: anchor all pid references in the initial pid
    namespace") introduced a find_vpid() call when adding/removing audit
    rules with PID/PPID filters; unfortunately this is problematic as
    find_vpid() only works if there is a task with the associated PID
    alive on the system.  The following commands demonstrate a simple
    	# auditctl -D
    	# auditctl -l
    	# autrace /bin/true
    	# auditctl -l
    This patch resolves the problem by simply using the PID provided by
    the user without any additional validation, e.g. no calls to check to
    see if the task/PID exists.
    Cc: stable@vger.kernel.org # 3.15
    Cc: Richard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
    Acked-by: default avatarEric Paris <eparis@redhat.com>
    Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
auditfilter.c 33.5 KB