From: Eric Paris <eparis@redhat.com>
Date: Wed, 19 Dec 2007 17:21:23 -0500
Subject: [audit] log uid, auid, and comm in obj_pid records
Message-id: 1198102883.6197.57.camel@localhost.localdomain
O-Subject: [RHEL5 PATCH] Audit: Log uid, auid, and comm in OBJ_PID records
Bugzilla: 284531

BZ 284531

http://www.redhat.com/archives/linux-audit/2007-December/msg00041.html

Add uid, loginuid, and comm collection to OBJ_PID records.  This just
gives users a little more information about the task that received a
signal.  pid is rather meaningless after the fact, and even though comm
isn't great we can't collect exe reasonably on this code path for
performance reasons.

Signed-off-by: Eric Paris <eparis@redhat.com>

Tested on a RHEL5 kernel and I get info.  When I tried to kill init I got:
type=OBJ_PID msg=audit(1198102793.667:20): opid=1 oauid=-1 ouid=0 obj=system_u:system_r:init_t:s0 ocomm="init"

Acked-by: James Morris <jmorris@redhat.com>

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 04db704..412a41c 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -175,7 +175,10 @@ struct audit_aux_data_sockaddr {
 struct audit_aux_data_pids {
 	struct audit_aux_data	d;
 	pid_t			target_pid[AUDIT_AUX_PIDS];
+	uid_t			target_auid[AUDIT_AUX_PIDS];
+	uid_t			target_uid[AUDIT_AUX_PIDS];
 	u32			target_sid[AUDIT_AUX_PIDS];
+	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
 	int			pid_count;
 };
 
@@ -217,7 +220,10 @@ struct audit_context {
 
 #ifndef __GENKSYMS__
 	pid_t		    target_pid;
+	uid_t		    target_auid;
+	uid_t		    target_uid;
 	u32		    target_sid;
+	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;
 	int tree_count;
@@ -925,7 +931,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
 }
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
-				 u32 sid)
+				 uid_t auid, uid_t uid, u32 sid, char *comm)
 {
 	struct audit_buffer *ab;
 	char *s = NULL;
@@ -937,11 +943,15 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
 	if (!ab)
 		return 0;
 
-	if (selinux_ctxid_to_string(sid, &s, &len)) {
-		audit_log_format(ab, "opid=%d obj=(none)", pid);
+	audit_log_format(ab, "opid=%d oauid=%d ouid=%d", pid, auid, uid);
+	if (selinux_sid_to_string(sid, &s, &len)) {
+		audit_log_format(ab, " obj=(none)");
 		rc = 1;
 	} else
-		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
+		audit_log_format(ab, " obj=%s", s);
+	audit_log_format(ab, " ocomm=");
+	audit_log_untrustedstring(ab, comm);
+
 	audit_log_end(ab);
 	kfree(s);
 
@@ -1120,13 +1130,17 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
 		for (i = 0; i < axs->pid_count; i++)
 			if (audit_log_pid_context(context, axs->target_pid[i],
-						  axs->target_sid[i]))
+						  axs->target_auid[i],
+						  axs->target_uid[i],
+						  axs->target_sid[i],
+						  axs->target_comm[i]))
 				call_panic = 1;
 	}
 
 	if (context->target_pid &&
 	    audit_log_pid_context(context, context->target_pid,
-				  context->target_sid))
+				  context->target_auid, context->target_uid,
+				  context->target_sid, context->target_comm))
 			call_panic = 1;
 
 	if (context->pwd && context->pwdmnt) {
@@ -2114,7 +2128,10 @@ void __audit_ptrace(struct task_struct *t)
 	struct audit_context *context = current->audit_context;
 
 	context->target_pid = t->pid;
+	context->target_auid = audit_get_loginuid(t->audit_context);
+	context->target_uid = t->uid;
 	selinux_task_ctxid(t, &context->target_sid);
+	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
 }
 
 /**
@@ -2151,7 +2168,10 @@ int __audit_signal_info(int sig, struct task_struct *t)
 	 * in audit_context */
 	if (!ctx->target_pid) {
 		ctx->target_pid = t->tgid;
+		ctx->target_auid = audit_get_loginuid(t->audit_context);
+		ctx->target_uid = t->uid;
 		selinux_get_task_sid(t, &ctx->target_sid);
+		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
 		return 0;
 	}
 
@@ -2168,7 +2188,10 @@ int __audit_signal_info(int sig, struct task_struct *t)
 	BUG_ON(axp->pid_count > AUDIT_AUX_PIDS);
 
 	axp->target_pid[axp->pid_count] = t->tgid;
+	axp->target_auid[axp->pid_count] = audit_get_loginuid(t->audit_context);
+	axp->target_uid[axp->pid_count] = t->uid;
 	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
+	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
 	axp->pid_count++;
 
 	return 0;