Commit 219ca394 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Eric Paris

audit: use union for audit_field values since they are mutually exclusive

Since only one of val, uid, gid and lsm* are used at any given time, combine
them to reduce the size of the struct audit_field.
Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
parent e7df61f4
...@@ -66,12 +66,16 @@ struct audit_krule { ...@@ -66,12 +66,16 @@ struct audit_krule {
struct audit_field { struct audit_field {
u32 type; u32 type;
u32 val; union {
kuid_t uid; u32 val;
kgid_t gid; kuid_t uid;
kgid_t gid;
struct {
char *lsm_str;
void *lsm_rule;
};
};
u32 op; u32 op;
char *lsm_str;
void *lsm_rule;
}; };
extern int is_audit_feature_set(int which); extern int is_audit_feature_set(int which);
......
...@@ -71,6 +71,24 @@ static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { ...@@ -71,6 +71,24 @@ static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
DEFINE_MUTEX(audit_filter_mutex); DEFINE_MUTEX(audit_filter_mutex);
static void audit_free_lsm_field(struct audit_field *f)
{
switch (f->type) {
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
case AUDIT_OBJ_USER:
case AUDIT_OBJ_ROLE:
case AUDIT_OBJ_TYPE:
case AUDIT_OBJ_LEV_LOW:
case AUDIT_OBJ_LEV_HIGH:
kfree(f->lsm_str);
security_audit_rule_free(f->lsm_rule);
}
}
static inline void audit_free_rule(struct audit_entry *e) static inline void audit_free_rule(struct audit_entry *e)
{ {
int i; int i;
...@@ -80,11 +98,8 @@ static inline void audit_free_rule(struct audit_entry *e) ...@@ -80,11 +98,8 @@ static inline void audit_free_rule(struct audit_entry *e)
if (erule->watch) if (erule->watch)
audit_put_watch(erule->watch); audit_put_watch(erule->watch);
if (erule->fields) if (erule->fields)
for (i = 0; i < erule->field_count; i++) { for (i = 0; i < erule->field_count; i++)
struct audit_field *f = &erule->fields[i]; audit_free_lsm_field(&erule->fields[i]);
kfree(f->lsm_str);
security_audit_rule_free(f->lsm_rule);
}
kfree(erule->fields); kfree(erule->fields);
kfree(erule->filterkey); kfree(erule->filterkey);
kfree(e); kfree(e);
...@@ -422,10 +437,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, ...@@ -422,10 +437,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
f->type = data->fields[i]; f->type = data->fields[i];
f->val = data->values[i]; f->val = data->values[i];
f->uid = INVALID_UID;
f->gid = INVALID_GID;
f->lsm_str = NULL;
f->lsm_rule = NULL;
/* Support legacy tests for a valid loginuid */ /* Support legacy tests for a valid loginuid */
if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) { if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment