From: Richard Guy Briggs <rgb@redhat•com>
To: Stephen Rothwell <sfr@canb•auug.org.au>
Cc: Eric Paris <eparis@redhat•com>,
linux-next@vger•kernel.org, linux-kernel@vger•kernel.org
Subject: Re: linux-next: manual merge of the audit tree with Linus' tree
Date: Tue, 1 Apr 2014 08:54:13 -0400 [thread overview]
Message-ID: <20140401125413.GB21711@madcap2.tricolour.ca> (raw)
In-Reply-To: <20140401150721.1e9d4e6c36660d5411c10f37@canb.auug.org.au>
On 14/04/01, Stephen Rothwell wrote:
> Hi Eric,
Hi Stephen,
> Today's linux-next merge of the audit tree got a conflict in
> kernel/audit.c between commit aa4af831bb4f ("AUDIT: Allow login in
> non-init namespaces") from Linus' tree and commit 5a3cb3b6c3a0 ("audit:
> allow user processes to log from another PID namespace") from the audit
> tree.
>
> I fixed it up (see below) and can carry the fix as necessary (no action
> is required).
I expected this conflict. Thanks for fixing it up!
> [Eric: that audit tree commit has no Signed-off-by from you even though
> you committed it ... there are a few like that]
I added my Signed-off to the list posting.
> --
> Cheers,
> Stephen Rothwell sfr@canb•auug.org.au
>
> diff --cc kernel/audit.c
> index 95a20f3f52f1,ad77d1e80895..000000000000
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@@ -607,20 -607,9 +607,19 @@@ static int audit_netlink_ok(struct sk_b
> {
> int err = 0;
>
> - /* Only support the initial namespaces for now. */
> + /* Only support initial user namespace for now. */
> + /*
> + * We return ECONNREFUSED because it tricks userspace into thinking
> + * that audit was not configured into the kernel. Lots of users
> + * configure their PAM stack (because that's what the distro does)
> + * to reject login if unable to send messages to audit. If we return
> + * ECONNREFUSED the PAM stack thinks the kernel does not have audit
> + * configured in and will let login proceed. If we return EPERM
> + * userspace will reject all logins. This should be removed when we
> + * support non init namespaces!!
> + */
> - if ((current_user_ns() != &init_user_ns) ||
> - (task_active_pid_ns(current) != &init_pid_ns))
> + if ((current_user_ns() != &init_user_ns))
> - return -EPERM;
> + return -ECONNREFUSED;
>
> switch (msg_type) {
> case AUDIT_LIST:
- RGB
--
Richard Guy Briggs <rbriggs@redhat•com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
next prev parent reply other threads:[~2014-04-01 12:54 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-01 4:07 linux-next: manual merge of the audit tree with Linus' tree Stephen Rothwell
2014-04-01 12:54 ` Richard Guy Briggs [this message]
2014-04-01 13:11 ` Stephen Rothwell
-- strict thread matches above, loose matches on Subject: below --
2019-04-08 1:31 Stephen Rothwell
2019-04-08 17:15 ` Dmitry V. Levin
2019-04-08 20:30 ` Paul Moore
2017-03-24 2:18 Stephen Rothwell
2017-03-24 6:33 ` Richard Guy Briggs
2017-03-24 16:39 ` Paul Moore
2017-01-19 2:51 Stephen Rothwell
2017-01-19 4:16 ` Richard Guy Briggs
2016-11-22 5:29 Stephen Rothwell
2016-11-22 10:35 ` Richard Guy Briggs
2016-11-22 21:25 ` Paul Moore
2016-01-19 1:02 Stephen Rothwell
2016-01-19 2:48 ` Paul Moore
2015-11-19 1:06 Stephen Rothwell
2015-11-19 15:53 ` Paul Moore
2015-11-19 18:30 ` Richard Guy Briggs
2015-11-19 20:16 ` Stephen Rothwell
2015-10-06 2:55 Stephen Rothwell
2015-10-06 17:21 ` Paul Moore
2015-08-07 4:15 Stephen Rothwell
2015-08-07 6:33 ` Richard Guy Briggs
2015-06-01 6:30 Stephen Rothwell
2015-06-01 15:59 ` Richard Guy Briggs
2015-01-20 4:04 Stephen Rothwell
2015-01-20 4:04 Stephen Rothwell
2015-01-20 15:45 ` Paul Moore
2015-01-20 4:03 Stephen Rothwell
2014-04-22 3:58 Stephen Rothwell
2014-04-16 4:02 Stephen Rothwell
2014-04-16 12:08 ` Eric Paris
2014-01-15 4:48 Stephen Rothwell
2013-11-06 6:19 Stephen Rothwell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140401125413.GB21711@madcap2.tricolour.ca \
--to=rgb@redhat$(echo .)com \
--cc=eparis@redhat$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=sfr@canb$(echo .)auug.org.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox