iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] Audit: make audit=0 actually turn off audit

Browse Source 
Currently audit=0 on the kernel command line does absolutely nothing.
Audit always loads and always uses its resources such as creating the
kernel netlink socket.  This patch causes audit=0 to actually disable
audit.  Audit will use no resources and starting the userspace auditd
daemon will not cause the kernel audit system to activate.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Eric Paris 2008-11-05 12:47:09 -05:00 committed by Al Viro
parent 218d11a8b0
commit a3f07114e3
1 changed files with 21 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
kernel/audit.c
View File

@ -61,8 +61,11 @@
#include "audit.h" #include "audit.h"
/* No auditing will take place until audit_initialized != 0. /* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
* (Initialization happens after skb_init is called.) */ * (Initialization happens after skb_init is called.) */
#define AUDIT_DISABLED -1
#define AUDIT_UNINITIALIZED 0
#define AUDIT_INITIALIZED 1
static int audit_initialized; static int audit_initialized;
#define AUDIT_OFF 0 #define AUDIT_OFF 0
@ -965,6 +968,9 @@ static int __init audit_init(void)
{ {
int i; int i;
if (audit_initialized == AUDIT_DISABLED)
return 0;
printk(KERN_INFO "audit: initializing netlink socket (%s)\n", printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
audit_default ? "enabled" : "disabled"); audit_default ? "enabled" : "disabled");
audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0, audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
@ -976,7 +982,7 @@ static int __init audit_init(void)
skb_queue_head_init(&audit_skb_queue); skb_queue_head_init(&audit_skb_queue);
skb_queue_head_init(&audit_skb_hold_queue); skb_queue_head_init(&audit_skb_hold_queue);
audit_initialized = 1; audit_initialized = AUDIT_INITIALIZED;
audit_enabled = audit_default; audit_enabled = audit_default;
audit_ever_enabled |= !!audit_default; audit_ever_enabled |= !!audit_default;
@ -999,13 +1005,21 @@ __initcall(audit_init);
static int __init audit_enable(char *str) static int __init audit_enable(char *str)
{ {
audit_default = !!simple_strtol(str, NULL, 0); audit_default = !!simple_strtol(str, NULL, 0);
printk(KERN_INFO "audit: %s%s\n", if (!audit_default)
audit_default ? "enabled" : "disabled", audit_initialized = AUDIT_DISABLED;
audit_initialized ? "" : " (after initialization)");
if (audit_initialized) { printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");
if (audit_initialized == AUDIT_INITIALIZED) {
audit_enabled = audit_default; audit_enabled = audit_default;
audit_ever_enabled |= !!audit_default; audit_ever_enabled |= !!audit_default;
} else if (audit_initialized == AUDIT_UNINITIALIZED) {
printk(" (after initialization)");
} else {
printk(" (until reboot)");
} }
printk("\n");
return 1; return 1;
} }
@ -1146,7 +1160,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
int reserve; int reserve;
unsigned long timeout_start = jiffies; unsigned long timeout_start = jiffies;
if (!audit_initialized) if (audit_initialized != AUDIT_INITIALIZED)
return NULL; return NULL;
if (unlikely(audit_filter_type(type))) if (unlikely(audit_filter_type(type)))