diff options
| author | Ricardo Robaina <rrobaina@redhat.com> | 2024-08-28 08:25:06 -0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-28 16:48:28 -0400 |
| commit | 61c60977926e15716f469577797cd86d0369cbaa (patch) | |
| tree | 0975824921e24fff52b27855c82f52632725f8c5 /kernel/auditfilter.c | |
| parent | 8400291e289ee6b2bf9779ff1c83a291501f017b (diff) | |
| download | lwn-61c60977926e15716f469577797cd86d0369cbaa.tar.gz lwn-61c60977926e15716f469577797cd86d0369cbaa.zip | |
audit: use task_tgid_nr() instead of task_pid_nr()
In a few audit records, PIDs were being recorded with task_pid_nr()
instead of task_tgid_nr().
$ grep "task_pid_nr" kernel/audit*.c
audit.c: task_pid_nr(current),
auditfilter.c: pid = task_pid_nr(current);
auditsc.c: audit_log_format(ab, " pid=%u", task_pid_nr(current));
For single-thread applications, the process id (pid) and the thread
group id (tgid) are the same. However, on multi-thread applications,
task_pid_nr() returns the current thread id (user-space's TID), while
task_tgid_nr() returns the main thread id (user-space's PID). Since
the users are more interested in the process id (pid), rather than the
thread id (tid), this patch converts these callers to the correct method.
Link: https://github.com/linux-audit/audit-kernel/issues/126
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/auditfilter.c')
| -rw-r--r-- | kernel/auditfilter.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index d6ef4f4f9cba..470041c49a44 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1344,7 +1344,7 @@ int audit_filter(int msgtype, unsigned int listtype) switch (f->type) { case AUDIT_PID: - pid = task_pid_nr(current); + pid = task_tgid_nr(current); result = audit_comparator(pid, f->op, f->val); break; case AUDIT_UID: |