)]}'
{
  "commit": "75c0371a2d385ecbd6e1f854d9dce20889f06736",
  "tree": "34a9988cfb3077c88a44b904f466d129b01caae9",
  "parents": [
    "4f42c288e66a3395e94158badbd182b2dae8eccb"
  ],
  "author": {
    "name": "Pavel Emelyanov",
    "email": "xemul@openvz.org",
    "time": "Thu Mar 20 15:39:41 2008 -0700"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Thu Mar 20 15:39:41 2008 -0700"
  },
  "message": "audit: netlink socket can be auto-bound to pid other than current-\u003epid (v2)\n\nFrom:\tPavel Emelyanov \u003cxemul@openvz.org\u003e\n\nThis patch is based on the one from Thomas.\n\nThe kauditd_thread() calls the netlink_unicast() and passes \nthe audit_pid to it. The audit_pid, in turn, is received from \nthe user space and the tool (I\u0027ve checked the audit v1.6.9) \nuses getpid() to pass one in the kernel. Besides, this tool \ndoesn\u0027t bind the netlink socket to this id, but simply creates \nit allowing the kernel to auto-bind one.\n\nThat\u0027s the preamble.\n\nThe problem is that netlink_autobind() _does_not_ guarantees\nthat the socket will be auto-bound to the current pid. Instead\nit uses the current pid as a hint to start looking for a free\nid. So, in case of conflict, the audit messages can be sent\nto a wrong socket. This can happen (it\u0027s unlikely, but can be)\nin case some task opens more than one netlink sockets and then\nthe audit one starts - in this case the audit\u0027s pid can be busy\nand its socket will be bound to another id.\n\nThe proposal is to introduce an audit_nlk_pid in audit subsys,\nthat will point to the netlink socket to send packets to. It\nwill most often be equal to audit_pid. The socket id can be \ngot from the skb\u0027s netlink CB right in the audit_receive_msg.\nThe audit_nlk_pid reset to 0 is not required, since all the\ndecisions are taken based on audit_pid value only.\n\nLater, if the audit tools will bind the socket themselves, the\nkernel will have to provide a way to setup the audit_nlk_pid\nas well.\n\nA good side effect of this patch is that audit_pid can later \nbe converted to struct pid, as it is not longer safe to use \npid_t-s in the presence of pid namespaces. But audit code still \nuses the tgid from task_struct in the audit_signal_info and in\nthe audit_filter_syscall.\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "10c4930c2bbfbe0e98a5b56ff61a953fd4017367",
      "old_mode": 33188,
      "old_path": "kernel/audit.c",
      "new_id": "be55cb5036330afc4ab1b759c301cd85542ae6ac",
      "new_mode": 33188,
      "new_path": "kernel/audit.c"
    }
  ]
}