diff options
| author | Sergio Correia <scorreia@redhat.com> | 2026-05-12 16:28:59 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-05-12 23:10:38 +0300 |
| commit | f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2 (patch) | |
| tree | f277375398036b8ed80313ac08bb76eea3c8082a /tools/lib/python | |
| parent | e4a640475e43f406fdfd56d370b1f34b0cbbc18d (diff) | |
| download | linux-f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2.tar.xz | |
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
AUDIT_ADD_RULE and AUDIT_DEL_RULE correctly check for AUDIT_LOCKED
and return -EPERM, but AUDIT_TRIM and AUDIT_MAKE_EQUIV do not. This
allows a process with CAP_AUDIT_CONTROL to modify directory tree
watches and equivalence mappings even when the audit configuration
has been locked, undermining the purpose of the lock.
Add AUDIT_LOCKED checks to both commands.
Cc: stable@vger.kernel.org
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sergio Correia <scorreia@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions