Page MenuHomeFreeBSD

auditd: Fix signal handling
ClosedPublic

Authored by des on Thu, Jun 4, 7:16 PM.
Tags
None
Referenced Files
F159339718: D57451.diff
Sat, Jun 13, 1:04 AM
Unknown Object (File)
Fri, Jun 12, 12:16 PM
Unknown Object (File)
Tue, Jun 9, 2:58 PM
Unknown Object (File)
Tue, Jun 9, 9:13 AM
Unknown Object (File)
Tue, Jun 9, 7:51 AM
Unknown Object (File)
Mon, Jun 8, 9:14 PM
Unknown Object (File)
Mon, Jun 8, 8:21 AM
Unknown Object (File)
Mon, Jun 8, 2:34 AM
Subscribers

Details

Summary

Rewrite the main loop to use ppoll() instead of just blocking on read,
blocking the signals we care about when we aren't polling.

I didn't bother replacing alarm() with setitimer(); the alarm code
is dead anyway since there is no way for max_idletime to acquire a
non-zero value.

While here, avoid leaking the pid file and trigger descriptors to the
log child.

PR: 295840
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 73713
Build 70596: arc lint + arc unit

Event Timeline

des requested review of this revision.Thu, Jun 4, 7:16 PM

polling not implemented

This revision is now accepted and ready to land.Fri, Jun 5, 2:01 PM
cperciva added a subscriber: cperciva.

MFC after: 1 minute
Accelerated MFC requested by: re (cperciva)

This revision now requires review to proceed.Fri, Jun 5, 9:38 PM
des planned changes to this revision.Fri, Jun 5, 9:53 PM

This still needs work: we should set the signal mask before installing signal handlers in register_daemon() rather than here, and the original mask should be a global variable so the auditwarnlog() child can restore it before exec()ing the script.

set signal mask before installing handlers

contrib/openbsm/bin/auditd/auditd.c
358 ↗(On Diff #179380)

This seems to mean that we end up going into auditd_wait_for_events with the original signal mask and all of our handled signals unmasked, doesn't it? We don't run auditd -l normally, so this gets called in setup() and reverts our signal mask before we start our main loop

contrib/openbsm/bin/auditd/auditd.c
358 ↗(On Diff #179380)

oh this was meant to go in close_misc() 🤦‍♂️

des marked an inline comment as done.Mon, Jun 8, 2:30 PM
This revision is now accepted and ready to land.Mon, Jun 8, 3:36 PM
This revision was automatically updated to reflect the committed changes.