Merge tag 'audit-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

c4b9570c · Linus Torvalds <[email protected]> · 2025-01-21 20:12:24 -08:00

Pull audit update from Paul Moore:
 "A single audit patch that fixes a problem when collecting pathnames
  for audit PATH records that was caused by some faulty pathname
  matching logic"

* tag 'audit-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: fix suffixed '/' filename matching

Commit: c4b9570cfb63501638db720f3bee9f6dfd044b82
Parents: 690ffcd8 · e92eebb0

Merge commit. Changes below are compared with the first parent: 690ffcd8.

Changes

1 files changed · +11 −4

File	Status	Add	Del	Content
kernel/auditfilter.c	modified	+11	−4	View file

kernel/auditfilter.c

View file

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index bceb9f5..e3f4201 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1319,13 +1319,20 @@ int audit_compare_dname_path(const struct qstr *dname, const char *path, int par
 	if (pathlen < dlen)
 		return 1;
 
-	parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
-	if (pathlen - parentlen != dlen)
-		return 1;
+	if (parentlen == AUDIT_NAME_FULL)
+		parentlen = parent_len(path);
 
 	p = path + parentlen;
 
-	return strncmp(p, dname->name, dlen);
+	/* handle trailing slashes */
+	pathlen -= parentlen;
+	while (p[pathlen - 1] == '/')
+		pathlen--;
+
+	if (pathlen != dlen)
+		return 1;
+
+	return memcmp(p, dname->name, dlen);
 }
 
 int audit_filter(int msgtype, unsigned int listtype)