diff options
| author | Eric Paris <eparis@redhat.com> | 2013-05-23 14:26:00 -0400 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-11-05 11:08:17 -0500 |
| commit | 21b85c31d23f2047d47e1f74bfa5caa8b75c1c77 (patch) | |
| tree | 08ac436415d71faeb2d4d89d7d549bf70ad1261c /kernel/auditsc.c | |
| parent | d040e5af380554c23ffe0a034ae5f3e53da93a1d (diff) | |
audit: audit feature to set loginuid immutable
This adds a new 'audit_feature' bit which allows userspace to set it
such that the loginuid is absolutely immutable, even if you have
CAP_AUDIT_CONTROL.
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel/auditsc.c')
| -rw-r--r-- | kernel/auditsc.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 924c0bf048d..63223d671a6 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1971,6 +1971,9 @@ static int audit_set_loginuid_perm(kuid_t loginuid) /* if we are unset, we don't need privs */ if (!audit_loginuid_set(current)) return 0; + /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/ + if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE)) + return -EPERM; /* it is set, you need permission */ if (!capable(CAP_AUDIT_CONTROL)) return -EPERM; |