Peter Zijlstra bdf4c48af2 audit: rework execve audit
The purpose of audit_bprm() is to log the argv array to a userspace daemon at
the end of the execve system call.  Since user-space hasn't had time to run,
this array is still in pristine state on the process' stack; so no need to
copy it, we can just grab it from there.

In order to minimize the damage to audit_log_*() copy each string into a
temporary kernel buffer first.

Currently the audit code requires that the full argument vector fits in a
single packet.  So currently it does clip the argv size to a (sysctl) limit,
but only when execve auditing is enabled.

If the audit protocol gets extended to allow for multiple packets this check
can be removed.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ollie Wild <aaw@google.com>
Cc: <linux-audit@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-19 10:04:45 -07:00
..
2007-07-16 16:03:25 -05:00
2007-07-16 09:05:43 -07:00
2007-05-17 05:23:04 -07:00
2007-05-08 11:14:59 -07:00
2007-07-17 10:23:06 -07:00
2007-07-16 09:05:41 -07:00
2007-07-19 10:04:41 -07:00
2007-07-16 09:05:48 -07:00
2007-07-19 10:04:41 -07:00
2007-07-16 09:05:52 -07:00
2007-07-19 10:04:41 -07:00
2007-05-17 05:23:04 -07:00
2007-05-17 05:23:04 -07:00
2007-07-16 09:05:50 -07:00
2007-07-19 10:04:41 -07:00
2007-07-16 09:05:47 -07:00
2007-05-21 09:18:19 -07:00
2007-07-10 08:03:34 +02:00
2007-07-16 09:05:50 -07:00
2007-07-19 10:04:43 -07:00
2006-12-07 08:39:25 -08:00
2007-05-18 13:09:34 -07:00
2007-05-15 08:54:00 -07:00
2007-07-19 10:04:45 -07:00
2007-05-21 09:18:19 -07:00
2007-05-08 11:15:01 -07:00
2007-05-08 11:15:09 -07:00
2007-07-16 09:05:48 -07:00
2007-07-18 08:50:18 -04:00
2007-05-09 06:44:57 +02:00
2007-07-18 19:17:19 -04:00
2007-05-11 08:29:36 -07:00
2007-07-10 08:04:16 +02:00
2007-07-10 08:04:15 +02:00
2007-05-09 07:10:02 +02:00
2007-07-16 09:05:46 -07:00
2007-05-18 13:09:34 -07:00