Commit 3640dcfa authored by Paul Moore's avatar Paul Moore

audit: don't attempt to lookup PIDs when changing PID filtering audit rules

Commit f1dc4867 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system.  The following commands demonstrate a simple

	# auditctl -D
	# auditctl -l
	# autrace /bin/true
	# auditctl -l

This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.

Cc: # 3.15
Cc: Richard Guy Briggs <>
Signed-off-by: default avatarPaul Moore <>
Acked-by: default avatarEric Paris <>
Reviewed-by: default avatarRichard Guy Briggs <>
parent 0f7e94ee
......@@ -444,19 +444,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
f->val = 0;
if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
struct pid *pid;
pid = find_vpid(f->val);
if (!pid) {
err = -ESRCH;
goto exit_free;
f->val = pid_nr(pid);
err = audit_field_valid(entry, f);
if (err)
goto exit_free;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment