d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Audit 'fd' and 'cmd' arguments to fcntl(2), and when generating BSM,

Browse Source 
always audit the file-descriptor number and vnode information for all
fnctl(2) commands, not just locking-related ones.  This was likely an
oversight in the original adaptation of this code from XNU.

MFC after:	3 days
Sponsored by:	DARPA, AFRL
This commit is contained in:
Robert Watson 2016-11-22 00:41:24 +00:00
parent 9fc3c7f733
commit 1279fdafce
2 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/kern/kern_descrip.c
View File

@ -495,6 +495,8 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg)
p = td->td_proc;
fdp = p->p_fd;
AUDIT_ARG_FD(cmd);
AUDIT_ARG_CMD(cmd);
switch (cmd) {
case F_DUPFD:
tmp = arg;

5
sys/security/audit/audit_bsm.c
View File

@ -979,10 +979,7 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
kau_write(rec, tok);
}
if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
ar->ar_arg_cmd == F_SETLKW) {
FD_VNODE1_TOKENS;
}
FD_VNODE1_TOKENS;
break;
case AUE_FCHFLAGS: