Sergio Correia 5b6da42fd8 audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV ...

commit f9e1c1324b upstream.

AUDIT_ADD_RULE and AUDIT_DEL_RULE correctly check for AUDIT_LOCKED
and return -EPERM, but AUDIT_TRIM and AUDIT_MAKE_EQUIV do not. This
allows a process with CAP_AUDIT_CONTROL to modify directory tree
watches and equivalence mappings even when the audit configuration
has been locked, undermining the purpose of the lock.

Add AUDIT_LOCKED checks to both commands.

Cc: stable@vger.kernel.org
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sergio Correia <scorreia@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-23 13:03:32 +02:00

..

bpf

bpf: allow UTF-8 literals in bpf_bprintf_prepare()

2026-05-23 13:03:19 +02:00

cgroup

cgroup/rdma: fix integer overflow in rdmacg_try_charge()

2026-05-23 13:03:26 +02:00

configs

Remove WARN_ALL_UNSEEDED_RANDOM kernel config option

2026-03-04 07:21:00 -05:00

debug

…

dma

dma: swiotlb: add KMSAN annotations to swiotlb_bounce()

2026-04-02 13:07:16 +02:00

entry

…

events

perf: Make sure to use pmu_ctx->pmu for groups

2026-04-02 13:07:12 +02:00

futex

futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

2026-05-23 13:03:30 +02:00

gcov

gcov: add support for GCC 15

2025-11-24 10:30:06 +01:00

irq

genirq/irq_sim: Initialize work context pointers properly

2026-01-11 15:22:27 +01:00

kcsan

kcsan: test: Initialize dummy variable

2025-08-15 12:08:49 +02:00

livepatch

livepatch: Match old_sympos 0 and 1 in klp_find_func()

2026-01-11 15:21:43 +01:00

locking

rtmutex: Use waiter::task instead of current in remove_waiter()

2026-05-17 17:13:33 +02:00

module

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-05-23 13:03:06 +02:00

power

PM: hibernate: Drain trailing zero pages on userspace restore

2026-04-02 13:07:22 +02:00

printk

printk: Check CON_SUSPEND when unblanking a console

2025-06-04 14:42:00 +02:00

rcu

rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

2026-03-25 11:06:01 +01:00

sched

sched: Use u64 for bandwidth ratio calculations

2026-05-17 17:13:49 +02:00

time

hrtimer: Reduce trace noise in hrtimer_start()

2026-05-23 13:03:06 +02:00

trace

tracing: branch: Fix inverted check on stat tracer registration

2026-05-23 13:03:27 +02:00

.gitignore

…

acct.c

acct: block access to kernel internal filesystems

2025-02-27 04:10:52 -08:00

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

2026-05-23 13:03:32 +02:00

audit.h

audit,module: restore audit logging in load failure case

2025-08-15 12:08:39 +02:00

auditfilter.c

…

auditsc.c

audit: fix incorrect inheritable capability in CAPSET records

2026-05-23 13:03:32 +02:00

backtracetest.c

…

bounds.c

…

capability.c

…

cfi.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

hrtimers: Handle CPU state correctly on hotplug

2025-01-23 17:21:17 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

…

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

exit: Sleep at TASK_IDLE when waiting for application core dump

2026-05-17 17:13:43 +02:00

extable.c

…

fail_function.c

…

fork.c

unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

2026-05-23 13:03:17 +02:00

freezer.c

sched,freezer: Remove unnecessary warning in __thaw_task

2025-08-15 12:09:07 +02:00

gen_kheaders.sh

kheaders: Ignore silly-rename files

2025-01-23 17:21:13 +01:00

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

jump_label: Fix static_key_slow_dec() yet again

2024-10-10 11:57:13 +02:00

kallsyms_internal.h

…

kallsyms_selftest.c

…

kallsyms_selftest.h

…

kallsyms.c

kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()

2026-03-04 07:19:45 -05:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.kexec

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

kcov: mark in_softirq_really() as __always_inline

2025-01-09 13:32:07 +01:00

kexec_core.c

crash: fix crashkernel resource shrink

2025-12-01 11:41:52 +01:00

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-04-10 14:37:34 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-03-04 07:21:13 -05:00

kexec_internal.h

…

kexec.c

…

kheaders.c

…

kprobes.c

kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()

2026-03-25 11:06:03 +01:00

ksyms_common.c

…

ksysfs.c

…

kthread.c

kthread: unpark only parked kthread

2024-10-17 15:24:37 +02:00

latencytop.c

…

Makefile

…

module_signature.c

…

notifier.c

…

nsproxy.c

…

numa.c

…

padata.c

padata: Put CPU offline callback in ONLINE section to allow failure

2026-05-23 13:03:11 +02:00

panic.c

objtool, panic: Disable SMAP in __stack_chk_fail()

2025-05-02 07:50:55 +02:00

params.c

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-05-23 13:03:06 +02:00

pid_namespace.c

…

pid_sysctl.h

…

pid.c

pid: Add a judgment for ns null in pid_nr_ns

2025-10-19 16:31:01 +02:00

profile.c

…

ptrace.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-15 14:50:29 +02:00

range.c

…

reboot.c

…

regset.c

regset: use kvzalloc() for regset_get_alloc()

2026-05-17 17:13:26 +02:00

relay.c

…

resource_kunit.c

…

resource.c

Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"

2026-01-11 15:21:34 +01:00

rseq.c

rseq: Clarify rseq registration rseq_size bound check comment

2026-03-25 11:05:30 +01:00

scftorture.c

…

scs.c

scs: fix a wrong parameter in __scs_magic

2026-01-11 15:22:00 +01:00

seccomp.c

seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast

2025-10-15 11:57:48 +02:00

signal.c

posix-timers: Target group sigqueue to current task only if not exiting

2024-12-09 10:33:11 +01:00

smp.c

smp: Fix up and expand the smp_call_function_many() kerneldoc

2025-10-15 11:57:53 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

lockdep: Fix wait context check on softirq for PREEMPT_RT

2025-06-04 14:41:55 +02:00

stackleak.c

…

stacktrace.c

…

static_call_inline.c

x86/static-call: provide a way to do very early static-call updates

2024-12-19 18:11:36 +01:00

static_call.c

…

stop_machine.c

…

sys_ni.c

…

sys.c

kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

2025-10-19 16:30:50 +02:00

sysctl-test.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-04-02 13:07:23 +02:00

task_work.c

task_work: Fix NMI race condition

2026-01-11 15:21:17 +01:00

taskstats.c

taskstats: set version in TGID exit notifications

2026-05-17 17:13:32 +02:00

torture.c

…

tracepoint.c

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

2026-05-17 17:13:50 +02:00

tsacct.c

…

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-03-04 07:19:49 -05:00

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

vhost_task.c

vhost: Take a reference on the task in struct vhost_task.

2025-10-02 13:42:51 +02:00

watch_queue.c

watch_queue: fix pipe accounting mismatch

2025-04-10 14:37:25 +02:00

watchdog_buddy.c

…

watchdog_perf.c

…

watchdog.c

watchdog: fix watchdog may detect false positive of softlockup

2025-06-27 11:08:49 +01:00

workqueue_internal.h

…

workqueue.c

workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path

2026-05-23 13:03:32 +02:00