diff --git a/lib/ratelimit.c b/lib/ratelimit.c index e01a93f46f833483680b876fe9df7573bf4c2281..b1e6efacf0e944d03d06a5291185e0e9379a2842 100644 --- a/lib/ratelimit.c +++ b/lib/ratelimit.c @@ -29,6 +29,8 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func) unsigned long flags; int ret; + return 1; + if (!rs->interval) return 1; diff --git a/security/selinux/avc.c b/security/selinux/avc.c index 884a014ce2b85a6437478b49c523c3425adedacc..7a84173c2e263e11f117f2bacde7a75c3d6fd381 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -696,6 +696,10 @@ static void avc_audit_pre_callback(struct audit_buffer *ab, void *a) audit_log_format(ab, " } for "); } +static char* g_sctx[] = {"u:r:hiprofilerd:s0", "u:r:hiprofiler_plugins:s0", "u:r:hiprofiler_cmd:s0", "u:r:hiperf:s0"}; +static char* g_tctx[] = {"u:r:hiprofilerd:s0", "u:r:hiprofiler_plugins:s0", "u:r:hiprofiler_cmd:s0", "u:r:hiperf:s0", "data_local_tmp:s0"}; +static char* g_class[] = {"capability", "dir", "file"}; + /** * avc_audit_post_callback - SELinux specific information * will be called by generic audit code @@ -713,23 +717,58 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) u32 tcontext_len; int rc; + int match1 = 1; + int match2 = 1; + int match3 = 1; + int match4 = 1; + int match5 = 1; + int match6 = 1; + rc = security_sid_to_context(sad->state, sad->ssid, &scontext, &scontext_len); if (rc) audit_log_format(ab, " ssid=%d", sad->ssid); - else + else { audit_log_format(ab, " scontext=%s", scontext); + match1 &= !strcmp(scontext, g_sctx[0]); + match2 &= !strcmp(scontext, g_sctx[1]); + match3 &= !strcmp(scontext, g_sctx[2]); + match4 &= !strcmp(scontext, g_sctx[3]); + } rc = security_sid_to_context(sad->state, sad->tsid, &tcontext, &tcontext_len); if (rc) audit_log_format(ab, " tsid=%d", sad->tsid); - else + else { audit_log_format(ab, " tcontext=%s", tcontext); + match1 &= !strcmp(tcontext, g_tctx[0]); + match2 &= !strcmp(tcontext, g_tctx[1]); + match3 &= !strcmp(tcontext, g_tctx[2]); + match4 &= !strcmp(tcontext, g_tctx[3]); + match5 &= !strcmp(tcontext, g_tctx[4]); + match6 &= !strcmp(tcontext, g_tctx[4]); + } tclass = secclass_map[sad->tclass-1].name; audit_log_format(ab, " tclass=%s", tclass); + match1 &= !strcmp(tclass, g_class[0]); + match2 &= !strcmp(tclass, g_class[0]); + match3 &= !strcmp(tclass, g_class[0]); + match4 &= !strcmp(tclass, g_class[0]); + + match5 &= !strcmp(tclass, g_class[1]); + match6 &= !strcmp(tclass, g_class[2]); + + + if (match1 || match2 || match3 || match4 || match5 || match6) { + pr_info("================avc callback start================="); + dump_stack(); + pr_info("================avc callback end, send signal================="); + force_sig(SIGABRT); + } + if (sad->denied) audit_log_format(ab, " permissive=%u", sad->result ? 0 : 1);