Subject: [PATCH 2/2] lost_reset: return value rather than sequence number when zero

Date: Wed, 22 Nov 2017 19:00:57 -0500

The kernel always returns negative values on error, so zero and anything

positive is valid success.  Lost_reset returned a positive value at the

time of reset, including zero that got interpreted as success and

replaced with the packet sequence number "2".

Rename audit_send() to __audit_send() and pass the sequence number back

via a parameter rather than return value.

Have a new stub audit_send() call __audit_send() and mimic the previous

behaviour of audit_send().

There are legacy functions that actually use a sequence number:

	audit_request_rules_list_data()

		delete_all_rules()

	audit_request_signal_info()

		src/auditd.c:get_reply()

A number of others don't appear to need it, but expose it in libaudit:

	audit_send_user_message()

       		audit_log_user_comm_message()

		audit_log_acct_message()

		audit_log_user_avc_message()

		audit_log_semanage_message()

		audit_log_user_command()

	audit_request_status()

	audit_set_enabled()

	audit_set_failure()

	audit_set_rate_limit()

	audit_set_backlog_limit()

	audit_set_backlog_wait_time()

	audit_add_rule_data()

	audit_delete_rule_data()

Passes all audit-testsuite tests.

See: https://github.com/linux-audit/audit-userspace/issues/31

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>

---

 lib/libaudit.c |  3 ++-

 lib/netlink.c  | 28 ++++++++++++++++++++--------

 lib/private.h  |  1 +

 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/lib/libaudit.c b/lib/libaudit.c

index a9ba575..aa8258c 100644

--- a/lib/libaudit.c

+++ b/lib/libaudit.c

@@ -519,6 +519,7 @@ int audit_set_backlog_wait_time(int fd, uint32_t bwt)

 int audit_reset_lost(int fd)

 {

 	int rc;

+	int seq;

 	struct audit_status s;

 	if ((audit_get_features() & AUDIT_FEATURE_BITMAP_LOST_RESET) == 0)

@@ -527,7 +528,7 @@ int audit_reset_lost(int fd)

 	memset(&s, 0, sizeof(s));

 	s.mask = AUDIT_STATUS_LOST;

 	s.lost = 0;

-	rc = audit_send(fd, AUDIT_SET, &s, sizeof(s));

+	rc = __audit_send(fd, AUDIT_SET, &s, sizeof(s), &seq;;

 	if (rc < 0)

 		audit_msg(audit_priority(errno),

 			"Error sending lost reset request (%s)", 

diff --git a/lib/netlink.c b/lib/netlink.c

index 6e23883..5b2028f 100644

--- a/lib/netlink.c

+++ b/lib/netlink.c

@@ -203,7 +203,7 @@ static int adjust_reply(struct audit_reply *rep, int len)

  *                   error:   -errno

  *                   short:   0

  */

-int audit_send(int fd, int type, const void *data, unsigned int size)

+int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq)

 {

 	static int sequence = 0;

 	struct audit_message req;

@@ -224,6 +224,7 @@ int audit_send(int fd, int type, const void *data, unsigned int size)

 	if (++sequence < 0) 

 		sequence = 1;

+	*seq = sequence;

 	memset(&req, 0, sizeof(req));

 	req.nlh.nlmsg_len = NLMSG_SPACE(size);

@@ -241,18 +242,29 @@ int audit_send(int fd, int type, const void *data, unsigned int size)

 		retval = sendto(fd, &req, req.nlh.nlmsg_len, 0,

 			(struct sockaddr*)&addr, sizeof(addr));

 	} while (retval < 0 && errno == EINTR);

-	if (retval == (int)req.nlh.nlmsg_len) {

-		if ((retval = check_ack(fd)) == 0)

-			return sequence;

-		else

-			return retval; 

-	}

-	if (retval < 0) 

+	if (retval == (int)req.nlh.nlmsg_len)

+		return check_ack(fd);

+	if (retval < 0) {

 		return -errno;

+	} else if (retval > 0) {

+		errno = EINVAL;

+		return -errno;

+	}

 	return 0;

 }

+int audit_send(int fd, int type, const void *data, unsigned int size)

+{

+	int rc;

+	int seq;

+

+	rc = __audit_send(fd, type, data, size, &seq;;

+	if (rc == 0)

+		rc = seq;

+	return rc;

+}

+

 /*

  * This function will take a peek into the next packet and see if there's

  * an error. If so, the error is returned and its non-zero. Otherwise a 

diff --git a/lib/private.h b/lib/private.h

index dbe0f74..560740f 100644

--- a/lib/private.h

+++ b/lib/private.h

@@ -121,6 +121,7 @@ void audit_msg(int priority, const char *fmt, ...)

 #endif

 extern int audit_send(int fd, int type, const void *data, unsigned int size);

+extern int __audit_send(int fd, int type, const void *data, unsigned int size, int *seq);

 AUDIT_HIDDEN_START

-- 

1.8.3.1