audit: don't attempt to lookup PIDs when changing PID filtering audit rules
authorPaul Moore <pmoore@redhat.com>
Fri, 19 Dec 2014 23:35:53 +0000 (18:35 -0500)
committerPaul Moore <pmoore@redhat.com>
Fri, 19 Dec 2014 23:35:53 +0000 (18:35 -0500)
commit3640dcfa4fd00cd91d88bb86250bdb496f7070c0
treede75adc9ca42230ba0f8aeb4255c3f120acb51d8
parent0f7e94ee40d06f7a04e039392dfee8244bd8a7e0
audit: don't attempt to lookup PIDs when changing PID filtering audit rules

Commit f1dc4867 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system.  The following commands demonstrate a simple
reproducer.

# auditctl -D
# auditctl -l
# autrace /bin/true
# auditctl -l

This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.

Cc: stable@vger.kernel.org # 3.15
Cc: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
kernel/auditfilter.c