[3.16.y-ckt stable] Patch "audit: don't attempt to lookup PIDs when changing PID filtering audit rules" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    audit: don't attempt to lookup PIDs when changing PID filtering audit rules

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt4.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 786b2af6dcab98065c3821fe60920f4aa0b78a32 Mon Sep 17 00:00:00 2001
From: Paul Moore <pmoore at redhat.com>
Date: Fri, 19 Dec 2014 18:35:53 -0500
Subject: audit: don't attempt to lookup PIDs when changing PID filtering audit
 rules

commit 3640dcfa4fd00cd91d88bb86250bdb496f7070c0 upstream.

Commit f1dc4867 ("audit: anchor all pid references in the initial pid
namespace") introduced a find_vpid() call when adding/removing audit
rules with PID/PPID filters; unfortunately this is problematic as
find_vpid() only works if there is a task with the associated PID
alive on the system.  The following commands demonstrate a simple
reproducer.

	# auditctl -D
	# auditctl -l
	# autrace /bin/true
	# auditctl -l

This patch resolves the problem by simply using the PID provided by
the user without any additional validation, e.g. no calls to check to
see if the task/PID exists.

Cc: Richard Guy Briggs <rgb at redhat.com>
Signed-off-by: Paul Moore <pmoore at redhat.com>
Acked-by: Eric Paris <eparis at redhat.com>
Reviewed-by: Richard Guy Briggs <rgb at redhat.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 kernel/auditfilter.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 8e9bc9c3dbb7..b2e63ba5f815 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -433,19 +433,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			f->val = 0;
 		}

-		if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
-			struct pid *pid;
-			rcu_read_lock();
-			pid = find_vpid(f->val);
-			if (!pid) {
-				rcu_read_unlock();
-				err = -ESRCH;
-				goto exit_free;
-			}
-			f->val = pid_nr(pid);
-			rcu_read_unlock();
-		}
-
 		err = audit_field_valid(entry, f);
 		if (err)
 			goto exit_free;
--
2.1.4