• Richard Guy Briggs's avatar
    audit: call audit_bprm() only once to add AUDIT_EXECVE information · 9410d228
    Richard Guy Briggs authored
    Move the audit_bprm() call from search_binary_handler() to exec_binprm().  This
    allows us to get rid of the mm member of struct audit_aux_data_execve since
    bprm->mm will equal current->mm.
    This also mitigates the issue that ->argc could be modified by the
    load_binary() call in search_binary_handler().
    audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
    context every time search_binary_handler() was recursively called.  Only one
    reference is necessary.
    Reported-by: default avatarOleg Nesterov <onestero@redhat.com>
    Cc: Eric Paris <eparis@redhat.com>
    Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    This patch is against 3.11, but was developed on Oleg's post-3.11 patches that
    introduce exec_binprm().
audit.h 10.1 KB