William Roberts
3f1c82502c
audit: Audit proc/<pid>/cmdline aka proctitle ...
During an audit event, cache and print the value of the process's
proctitle value (proc/<pid>/cmdline). This is useful in situations
where processes are started via fork'd virtual machines where the
comm field is incorrect. Often times, setting the comm field still
is insufficient as the comm width is not very wide and most
virtual machine "package names" do not fit. Also, during execution,
many threads have their comm field set as well. By tying it back to
the global cmdline value for the process, audit records will be more
complete in systems with these properties. An example of where this
is useful and applicable is in the realm of Android. With Android,
their is no fork/exec for VM instances. The bare, preloaded Dalvik
VM listens for a fork and specialize request. When this request comes
in, the VM forks, and the loads the specific application (specializing).
This was done to take advantage of COW and to not require a load of
basic packages by the VM on very app spawn. When this spawn occurs,
the package name is set via setproctitle() and shows up in procfs.
Many of these package names are longer then 16 bytes, the historical
width of task->comm. Having the cmdline in the audit records will
couple the application back to the record directly. Also, on my
Debian development box, some audit records were more useful then
what was printed under comm.
The cached proctitle is tied to the life-cycle of the audit_context
structure and is built on demand.
Proctitle is controllable by userspace, and thus should not be trusted.
It is meant as an aid to assist in debugging. The proctitle event is
emitted during syscall audits, and can be filtered with auditctl.
Example:
type=AVC msg=audit(1391217013.924:386): avc: denied { getattr } for pid=1971 comm="mkdir" name="/" dev="selinuxfs" ino=1 scontext=system_u:system_r:consolekit_t:s0-s0:c0.c255 tcontext=system_u:object_r:security_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1391217013.924:386): arch=c000003e syscall=137 success=yes exit=0 a0=7f019dfc8bd7 a1=7fffa6aed2c0 a2=fffffffffff4bd25 a3=7fffa6aed050 items=0 ppid=1967 pid=1971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mkdir" exe="/bin/mkdir" subj=system_u:system_r:consolekit_t:s0-s0:c0.c255 key=(null)
type=UNKNOWN[1327] msg=audit(1391217013.924:386): proctitle=6D6B646972002D70002F7661722F72756E2F636F6E736F6C65
Acked-by: Steve Grubb <sgrubb@redhat.com> (wrt record formating)
Signed-off-by: William Roberts <wroberts@tresys.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2014-03-20 10:10:52 -04:00
sched: Add NEED_RESCHED to the preempt_count
2013-09-25 14:07:49 +02:00
kdb: Add support for external NMI handler to call KGDB/KDB
2013-10-03 18:47:54 +02:00
perf: Disable all pmus on unthrottling and rescheduling
2013-12-17 15:04:00 +01:00
gcov: reuse kbasename helper
2013-11-13 12:09:34 +09:00
Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-12-02 10:15:39 -08:00
locking/lockdep: Mark __lockdep_count_forward_deps() as static
2013-11-13 13:50:17 +01:00
PM / sleep: Fix memory leak in pm_vt_switch_unregister().
2013-12-22 00:56:35 +01:00
printk.c: comments should refer to /proc/vmcore instead of /proc/vmcoreinfo
2013-11-13 12:09:14 +09:00
NOHZ: Check for nohz active instead of nohz enabled
2013-11-19 14:59:50 +01:00
sched: Calculate effective load even if local weight is 0
2014-01-12 09:22:15 +01:00
sched_clock: Disable seqlock lockdep usage in sched_clock()
2014-01-12 10:14:00 +01:00
This fixes a long standing bug in the ftrace profiler.
2013-12-20 09:32:30 -08:00
Ignore generated file kernel/x509_certificate_list
2013-12-10 18:21:34 +00:00
fs: Fix hang with BSD accounting on frozen filesystem
2013-05-04 14:57:58 -04:00
async: rename and redefine async_func_ptr
2013-03-12 13:59:14 -07:00
audit: fix location of __net_initdata for audit_net_ops
2014-01-17 17:14:32 -05:00
audit: Audit proc/<pid>/cmdline aka proctitle
2014-03-20 10:10:52 -04:00
kernel/audit_tree.c:audit_add_tree_rule(): protect `rule' from kill_rules()
2013-06-12 16:29:46 -07:00
audit: Use more current logging style again
2014-03-07 11:48:15 -05:00
audit: Audit proc/<pid>/cmdline aka proctitle
2014-03-20 10:10:52 -04:00
mm: do not allocate page->ptl dynamically, if spinlock_t fits to long
2013-12-20 12:25:45 -08:00
audit: Simplify and correct audit_log_capset
2014-01-13 22:26:48 -05:00
cgroup: don't recycle cgroup id until all csses' have been destroyed
2013-12-17 08:11:52 -05:00
cgroup: make css_for_each_descendant() and friends include the origin css in the iteration
2013-08-08 20:11:27 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2013-05-01 07:21:43 -07:00
proc: Supply PDE attribute setting accessor functions
2013-05-01 17:29:18 -04:00
Linux 3.12-rc4
2013-10-09 12:36:13 +02:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-11-14 16:55:11 +09:00
cpuset: Fix memory allocator deadlock
2013-11-27 13:52:47 -05:00
kernel/delayacct.c: remove redundant checking in __delayacct_add_tsk()
2013-11-13 12:09:12 +09:00
switch elf_core_write_extra_phdrs() to dump_emit()
2013-11-09 00:16:23 -05:00
ptrace: revert "Prepare to fix racy accesses on task breakpoints"
2013-07-09 10:33:26 -07:00
kernel/extable: fix address-checks for core_kernel and init areas
2013-11-28 09:49:41 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2014-01-17 17:29:36 -08:00
libata, freezer: avoid block device removal while system is frozen
2013-12-19 13:50:32 -05:00
futex: move user address verification up to common code
2013-12-12 09:53:51 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal
2013-02-23 18:50:11 -08:00
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
Here are the 3.13 KVM changes. There was a lot of work on the PPC
2013-11-15 13:51:36 +09:00
static_key: WARN on usage before jump_label_init was called
2013-10-19 19:45:35 -04:00
kernel: kallsyms: memory override issue, need check destination buffer length
2013-04-15 15:17:26 +09:30
kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS
2013-11-15 09:32:22 +09:00
locking: Fix copy/paste errors of "ARCH_INLINE_*_UNLOCK_BH"
2013-05-28 08:50:00 +02:00
kexec: migrate to reboot cpu
2013-12-18 19:04:50 -08:00
kernel/kmod.c: check for NULL in call_usermodehelper_exec()
2013-09-30 14:31:02 -07:00
kprobes: use KSYM_NAME_LEN to size identifier buffers
2013-11-13 12:09:26 +09:00
kernel: replace strict_strto*() with kstrto*()
2013-09-12 15:38:03 -07:00
kthread: make kthread_create() killable
2013-11-13 12:08:59 +09:00
KEYS: Remove files generated when SYSTEM_TRUSTED_KEYRING=y
2013-12-13 15:59:11 +00:00
KEYS: Separate the kernel signature checking keyring from module signing
2013-09-25 17:17:01 +01:00
Mainly boring here, too. rmmod --wait finally removed, though.
2013-11-15 13:27:50 +09:00
keys: change asymmetric keys to use common hash definitions
2013-10-25 17:15:18 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2013-09-07 14:35:32 -07:00
padata: make the sequence counter an atomic_t
2013-10-30 12:02:58 +08:00
kernel/panic.c: reduce 1 byte usage for print tainted buffer
2013-11-13 12:09:35 +09:00
kernel/params: fix handling of signed integer types
2013-09-28 12:35:52 -07:00
pidns: fix free_pid() to handle the first fork failure
2013-09-30 14:31:03 -07:00
pid_namespace: make freeing struct pid_namespace rcu-delayed
2013-10-24 23:43:29 -04:00
posix_timers: fix racy timer delta caching on task exit
2013-07-03 16:54:42 +02:00
posix-timers: Remove unused variable
2013-04-18 12:51:19 +02:00
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
exec/ptrace: fix get_dumpable() incorrect tests
2013-11-13 12:09:33 +09:00
range: Do not add new blank slot with add_range_with_merge
2013-06-18 11:32:10 -05:00
kexec: migrate to reboot cpu
2013-12-18 19:04:50 -08:00
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
memcg: reduce function dereference
2013-09-12 15:38:02 -07:00
kernel/resource.c: remove the unneeded assignment in function __find_resource
2013-07-03 16:08:06 -07:00
seccomp: allow BPF_XOR based ALU instructions.
2013-03-26 11:07:19 +11:00
constify copy_siginfo_to_user{,32}()
2013-11-09 00:16:29 -05:00
kernel: fix generic_exec_single indentation
2013-11-15 09:32:22 +09:00
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
revert "softirq: Add support for triggering softirq work on softirqs"
2013-11-15 09:32:22 +09:00
stop_machine: Fix race between stop_two_cpus() and stop_cpus()
2013-11-11 12:43:38 +01:00
kernel/sys.c: remove obsolete #include <linux/kexec.h>
2013-11-13 12:09:13 +09:00
unify compat fanotify_mark(2), switch to COMPAT_SYSCALL_DEFINE
2013-05-09 13:46:38 -04:00
Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-11-14 16:30:30 +09:00
kernel/sysctl_binary.c: use scnprintf() instead of snprintf()
2013-11-13 12:09:33 +09:00
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
task_work: documentation
2013-09-11 15:58:27 -07:00
genetlink: only pass array to genl_register_family_with_ops()
2013-11-19 16:39:05 -05:00
kernel/: rename random32() to prandom_u32()
2013-04-29 18:28:42 -07:00
sched: Rename sched.c as sched/core.c in comments and Documentation
2013-06-19 12:58:42 +02:00
kernel: Replace timeconst.pl with a bc script
2013-02-16 23:17:25 +01:00
timer: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...)
2013-11-19 14:59:50 +01:00
Tracing updates for Linux 3.10
2013-04-29 13:55:38 -07:00
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
kernel: provide a __smp_call_function_single stub for !CONFIG_SMP
2013-11-15 09:32:22 +09:00
hlist: drop the node parameter from iterators
2013-02-27 19:10:24 -08:00
KEYS: fix uninitialized persistent_keyring_register_sem
2013-12-13 15:59:11 +00:00
KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches
2013-09-24 10:35:19 +01:00
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
kernel/utsname_sysctl.c: put get/get_uts() into CONFIG_PROC_SYSCTL code block
2013-02-27 19:10:22 -08:00
watchdog: update watchdog_thresh properly
2013-09-24 17:00:25 -07:00
PCI updates for v3.13:
2013-12-15 11:45:27 -08:00
sched: Rename sched.c as sched/core.c in comments and Documentation
2013-06-19 12:58:42 +02:00
3f1c82502c