OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

audit: do not panic on invalid boot parameter 

If you pass in an invalid audit boot parameter value, e.g. "audit=off",
the kernel panics very early in boot before the regular console is
initialized.  Unless you have earlyprintk enabled, there is no
indication of what the problem is on the console.

Convert the panic() calls to pr_err(), and leave auditing enabled if an
invalid parameter value was passed in.

Modify the parameter to also accept "on" or "off" as valid values, and
update the documentation accordingly.

Signed-off-by: Greg Edwards <gedwards@ddn.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Greg Edwards 2018-03-05 15:05:20 -07:00 committed by Paul Moore
parent ce423631ce
commit 11dd266637
2 changed files with 21 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Documentation/admin-guide/kernel-parameters.txt
View File

@ -387,15 +387,15 @@
Use software keyboard repeat
audit= [KNL] Enable the audit sub-system
Format: { "0" | "1" } (0 = disabled, 1 = enabled)
0 - kernel audit is disabled and can not be enabled
until the next reboot
Format: { "0" | "1" | "off" | "on" }
0 | off - kernel audit is disabled and can not be
enabled until the next reboot
unset - kernel audit is initialized but disabled and
will be fully enabled by the userspace auditd.
1 - kernel audit is initialized and partially enabled,
storing at most audit_backlog_limit messages in
RAM until it is fully enabled by the userspace
auditd.
1 | on - kernel audit is initialized and partially
enabled, storing at most audit_backlog_limit
messages in RAM until it is fully enabled by the
userspace auditd.
Default: unset
audit_backlog_limit= [KNL] Set the audit queue size limit.

21
kernel/audit.c
View File

@ -1615,19 +1615,26 @@ static int __init audit_init(void)
}
postcore_initcall(audit_init);
/* Process kernel command-line parameter at boot time. audit=0 or audit=1. */
/*
* Process kernel command-line parameter at boot time.
* audit={0|off} or audit={1|on}.
*/
static int __init audit_enable(char *str)
{
long val;
if (kstrtol(str, 0, &val))
panic("audit: invalid 'audit' parameter value (%s)\n", str);
audit_default = (val ? AUDIT_ON : AUDIT_OFF);
if (!strcasecmp(str, "off") || !strcmp(str, "0"))
audit_default = AUDIT_OFF;
else if (!strcasecmp(str, "on") || !strcmp(str, "1"))
audit_default = AUDIT_ON;
else {
pr_err("audit: invalid 'audit' parameter value (%s)\n", str);
audit_default = AUDIT_ON;
}
if (audit_default == AUDIT_OFF)
audit_initialized = AUDIT_DISABLED;
if (audit_set_enabled(audit_default))
panic("audit: error setting audit state (%d)\n", audit_default);
pr_err("audit: error setting audit state (%d)\n",
audit_default);
pr_info("%s\n", audit_default ?
"enabled (after initialization)" : "disabled (until reboot)");