Skip to content

Commit 72375b6

Browse files
committed
audit: fix suffixed '/' filename matching
JIRA: https://issues.redhat.com/browse/RHEL-78967 JIRA: https://issues.redhat.com/browse/RHEL-90107 This patch is a backport of the following upstream commit: commit e92eebb Author: Ricardo Robaina <rrobaina@redhat.com> Date: Fri Nov 22 09:18:43 2024 -0300 audit: fix suffixed '/' filename matching When the user specifies a directory to delete with the suffix '/', the audit record fails to collect the filename, resulting in the following logs: type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=2 name=(null) type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=1 name=(null) It happens because the value of the variables dname, and n->name->name in __audit_inode_child() differ only by the suffix '/'. This commit treats this corner case by handling pathname's trailing slashes in audit_compare_dname_path(). Steps to reproduce the issue: # auditctl -w /tmp $ mkdir /tmp/foo $ rm -r /tmp/foo/ # ausearch -i | grep PATH | tail -3 The first version of this patch was based on a GitHub patch/PR by user @hqh2010 [1]. Link: linux-audit/audit-kernel#148 [1] Suggested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Reviewed-by: Richard Guy Briggs <rgb@redhat.com> [PM: subject tweak, trim old metadata] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
1 parent d0d3c00 commit 72375b6

File tree

1 file changed

+11
-4
lines changed

1 file changed

+11
-4
lines changed

kernel/auditfilter.c

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1318,13 +1318,20 @@ int audit_compare_dname_path(const struct qstr *dname, const char *path, int par
13181318
if (pathlen < dlen)
13191319
return 1;
13201320

1321-
parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
1322-
if (pathlen - parentlen != dlen)
1323-
return 1;
1321+
if (parentlen == AUDIT_NAME_FULL)
1322+
parentlen = parent_len(path);
13241323

13251324
p = path + parentlen;
13261325

1327-
return strncmp(p, dname->name, dlen);
1326+
/* handle trailing slashes */
1327+
pathlen -= parentlen;
1328+
while (p[pathlen - 1] == '/')
1329+
pathlen--;
1330+
1331+
if (pathlen != dlen)
1332+
return 1;
1333+
1334+
return memcmp(p, dname->name, dlen);
13281335
}
13291336

13301337
int audit_filter(int msgtype, unsigned int listtype)

0 commit comments

Comments
 (0)