diff options
| author |   Ricardo Robaina <rrobaina@redhat.com> | 2024-11-22 09:18:43 -0300 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2024-12-05 19:22:38 -0500 |
| commit | e92eebb0d6116f942ab25dfb1a41905aa59472a8 (patch) | |
| tree | a271cdb8eceaa471a62f0df342972fb881c0c8f2 | |
| parent | Linux 6.13-rc1 (diff) | |
| download | wireguard-linux-e92eebb0d6116f942ab25dfb1a41905aa59472a8.tar.xz wireguard-linux-e92eebb0d6116f942ab25dfb1a41905aa59472a8.zip | |
audit: fix suffixed '/' filename matching
When the user specifies a directory to delete with the suffix '/',
the audit record fails to collect the filename, resulting in the
following logs:
type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=2 name=(null)
type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=1 name=(null)
It happens because the value of the variables dname, and n->name->name
in __audit_inode_child() differ only by the suffix '/'. This commit
treats this corner case by handling pathname's trailing slashes in
audit_compare_dname_path().
Steps to reproduce the issue:
# auditctl -w /tmp
$ mkdir /tmp/foo
$ rm -r /tmp/foo/
# ausearch -i | grep PATH | tail -3
The first version of this patch was based on a GitHub patch/PR by
user @hqh2010 [1].
Link: https://github.com/linux-audit/audit-kernel/pull/148 [1]
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: subject tweak, trim old metadata]
Signed-off-by: Paul Moore <paul@paul-moore.com>
| -rw-r--r-- | kernel/auditfilter.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index bceb9f58a09e..e3f42018ed46 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1319,13 +1319,20 @@ int audit_compare_dname_path(const struct qstr *dname, const char *path, int par if (pathlen < dlen) return 1; - parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; - if (pathlen - parentlen != dlen) - return 1; + if (parentlen == AUDIT_NAME_FULL) + parentlen = parent_len(path); p = path + parentlen; - return strncmp(p, dname->name, dlen); + /* handle trailing slashes */ + pathlen -= parentlen; + while (p[pathlen - 1] == '/') + pathlen--; + + if (pathlen != dlen) + return 1; + + return memcmp(p, dname->name, dlen); } int audit_filter(int msgtype, unsigned int listtype) |