| Message ID | 20240828112528.954163-1-rrobaina@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | [v2] audit: use task_tgid_nr() instead of task_pid_nr() | expand |
On Aug 28, 2024 Ricardo Robaina <rrobaina@redhat.com> wrote: > > In a few audit records, PIDs were being recorded with task_pid_nr() > instead of task_tgid_nr(). > > $ grep "task_pid_nr" kernel/audit*.c > audit.c: task_pid_nr(current), > auditfilter.c: pid = task_pid_nr(current); > auditsc.c: audit_log_format(ab, " pid=%u", task_pid_nr(current)); > > For single-thread applications, the process id (pid) and the thread > group id (tgid) are the same. However, on multi-thread applications, > task_pid_nr() returns the current thread id (user-space's TID), while > task_tgid_nr() returns the main thread id (user-space's PID). Since > the users are more interested in the process id (pid), rather than the > thread id (tid), this patch converts these callers to the correct method. > > Link: https://github.com/linux-audit/audit-kernel/issues/126 > > Reviewed-by: Richard Guy Briggs <rgb@redhat.com> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> > --- > V1 -> V2: Added a more detailed commit description > > kernel/audit.c | 2 +- > kernel/auditfilter.c | 2 +- > kernel/auditsc.c | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) Looks good to me, merged into audit/dev, thanks! -- paul-moore.com
diff --git a/kernel/audit.c b/kernel/audit.c index e7a62ebbf4d1..9f6b86acab62 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1612,7 +1612,7 @@ static void audit_log_multicast(int group, const char *op, int err) cred = current_cred(); tty = audit_get_tty(); audit_log_format(ab, "pid=%u uid=%u auid=%u tty=%s ses=%u", - task_pid_nr(current), + task_tgid_nr(current), from_kuid(&init_user_ns, cred->uid), from_kuid(&init_user_ns, audit_get_loginuid(current)), tty ? tty_name(tty) : "(none)", diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index d6ef4f4f9cba..470041c49a44 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1344,7 +1344,7 @@ int audit_filter(int msgtype, unsigned int listtype) switch (f->type) { case AUDIT_PID: - pid = task_pid_nr(current); + pid = task_tgid_nr(current); result = audit_comparator(pid, f->op, f->val); break; case AUDIT_UID: diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6f0d6fb6523f..cd57053b4a69 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2933,7 +2933,7 @@ void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, audit_log_format(ab, "table=%s family=%u entries=%u op=%s", name, af, nentries, audit_nfcfgs[op].s); - audit_log_format(ab, " pid=%u", task_pid_nr(current)); + audit_log_format(ab, " pid=%u", task_tgid_nr(current)); audit_log_task_context(ab); /* subj= */ audit_log_format(ab, " comm="); audit_log_untrustedstring(ab, get_task_comm(comm, current));