Sergio Correia e8085ad769 audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV ...

commit f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2 upstream.

AUDIT_ADD_RULE and AUDIT_DEL_RULE correctly check for AUDIT_LOCKED
and return -EPERM, but AUDIT_TRIM and AUDIT_MAKE_EQUIV do not. This
allows a process with CAP_AUDIT_CONTROL to modify directory tree
watches and equivalence mappings even when the audit configuration
has been locked, undermining the purpose of the lock.

Add AUDIT_LOCKED checks to both commands.

Cc: stable@vger.kernel.org
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sergio Correia <scorreia@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2026-06-29 10:46:10 +02:00

..

bpf

bpf: Fix regsafe() for pointers to packet

2026-05-07 10:55:23 +02:00

cgroup

cgroup/rdma: fix integer overflow in rdmacg_try_charge()

2026-06-29 10:46:07 +02:00

configs

…

debug

kdb: Use the passed prompt in kdb_position_cursor()

2024-08-19 05:32:06 +02:00

dma

dma: fix call order in dmam_free_coherent

2024-08-19 05:32:06 +02:00

events

uprobe: Do not emulate/sstep original instruction when ip is changed

2025-12-22 04:34:05 +01:00

gcov

gcov: add support for GCC 15

2025-12-22 04:34:09 +01:00

irq

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

2024-06-16 13:23:38 +02:00

livepatch

livepatch: fix race between fork and KLP transition

2022-10-26 13:19:23 +02:00

locking

locking/spinlock/debug: Fix data-race in do_raw_write_lock

2026-01-26 16:51:54 +08:00

power

PM: sleep: console: Fix the black screen issue

2025-09-16 13:55:14 +02:00

printk

printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX

2025-04-03 10:09:48 +02:00

rcu

rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment

2024-07-05 09:00:26 +02:00

sched

sched: idle: Make skipping governor callbacks more consistent

2026-05-07 10:55:15 +02:00

time

alarmtimer: Fix argument order in alarm_timer_forward()

2026-05-07 10:55:21 +02:00

trace

tracing: branch: Fix inverted check on stat tracer registration

2026-06-29 10:46:08 +02:00

.gitignore

…

acct.c

acct: perform last write from workqueue

2025-04-04 11:11:29 +02:00

async.c

treewide: Remove uninitialized_var() usage

2023-08-11 11:45:01 +02:00

audit_fsnotify.c

audit: fix potential double free on error path from fsnotify_add_inode_mark

2022-09-05 10:26:28 +02:00

audit_tree.c

…

audit_watch.c

audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()

2023-11-28 16:46:34 +00:00

audit.c

audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

2026-06-29 10:46:10 +02:00

audit.h

audit: fix a net reference leak in audit_list_rules_send()

2020-06-22 09:05:13 +02:00

auditfilter.c

audit: fix a net reference leak in audit_list_rules_send()

2020-06-22 09:05:13 +02:00

auditsc.c

audit: fix incorrect inheritable capability in CAPSET records

2026-06-29 10:46:10 +02:00

backtracetest.c

…

bounds.c

…

capability.c

…

compat.c

sched_getaffinity: don't assume 'cpumask_size()' is fully initialized

2023-04-05 11:15:39 +02:00

configs.c

…

context_tracking.c

…

cpu_pm.c

kernel/cpu_pm: Fix uninitted local in cpu_pm

2020-06-22 09:05:28 +02:00

cpu.c

hrtimers: Push pending hrtimers away from outgoing CPU earlier

2023-12-13 17:42:15 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

cred: switch to using atomic_long_t

2023-12-20 15:38:01 +01:00

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-28 15:32:29 +08:00

extable.c

kernel/extable.c: use address-of operator on section symbols

2023-06-09 10:24:02 +02:00

fail_function.c

fail_function: Remove a redundant mutex unlock

2020-11-24 13:27:23 +01:00

fork.c

unshare: fix unshare_fs() handling

2026-05-07 10:55:14 +02:00

freezer.c

…

futex.c

treewide: Remove uninitialized_var() usage

2023-08-11 11:45:01 +02:00

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

locking/static_key: Fix false positive warnings on concurrent dec/inc

2021-03-04 09:39:30 +01:00

kallsyms.c

kallsyms: Refactor kallsyms_show_value() to take cred

2020-07-16 08:17:26 +02:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

…

kexec_core.c

kexec: fix a memory leak in crash_shrink_memory()

2023-08-11 11:45:06 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-04-12 13:56:51 +08:00

kexec_internal.h

…

kexec.c

…

kmod.c

kmod: make request_module() return an error when autoloading is disabled

2020-04-17 10:48:52 +02:00

kprobes.c

kprobes: Fix possible use-after-free issue on kprobe registration

2024-05-02 16:17:09 +02:00

ksysfs.c

…

kthread.c

kthread: fix task state in kthread worker if being frozen

2024-11-08 16:19:06 +01:00

latencytop.c

…

Makefile

elfcore: fix building with clang

2021-02-10 09:21:06 +01:00

memremap.c

…

module_signing.c

…

module-internal.h

…

module.c

modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules

2023-09-23 10:47:56 +02:00

notifier.c

…

nsproxy.c

…

padata.c

padata: fix sysfs store callback check

2025-04-03 10:09:44 +02:00

panic.c

exit: Use READ_ONCE() for all oops/warn limit reads

2023-02-06 07:49:46 +01:00

params.c

module: ensure that kobject_put() is safe for module type kobjects

2025-07-17 10:07:54 +02:00

pid_namespace.c

memcg: enable accounting for pids in nested pid namespaces

2021-09-22 11:48:09 +02:00

pid.c

pid: Add a judgment for ns null in pid_nr_ns

2025-11-17 10:36:42 +01:00

profile.c

profiling: fix shift too large makes kernel panic

2022-08-25 11:15:20 +02:00

ptrace.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-28 15:32:29 +08:00

range.c

…

reboot.c

reboot: fix overflow parsing reboot cpu number

2020-11-18 19:18:52 +01:00

relay.c

relayfs: fix out-of-bounds access in relay_file_read

2023-05-17 11:13:23 +02:00

resource.c

…

rseq.c

…

seccomp.c

seccomp: Invalidate seccomp mode to catch death failures

2022-02-16 12:51:47 +01:00

signal.c

signal: Replace BUG_ON()s

2024-11-08 16:19:12 +01:00

smp.c

smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()

2024-09-12 11:02:53 +02:00

smpboot.c

kthread: Extract KTHREAD_IS_PER_CPU

2021-02-07 14:48:38 +01:00

smpboot.h

…

softirq.c

…

stacktrace.c

…

stop_machine.c

…

sys_ni.c

kernel/sys_ni: add compat entry for fadvise64_64

2022-09-05 10:26:28 +02:00

sys.c

Revert "y2038: rusage: use __kernel_old_timeval"

2024-05-02 16:17:14 +02:00

sysctl_binary.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-05-07 10:55:21 +02:00

task_work.c

…

taskstats.c

taskstats: set version in TGID exit notifications

2026-06-29 10:45:54 +02:00

test_kprobes.c

…

torture.c

…

tracepoint.c

tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing

2021-07-20 16:15:42 +02:00

tsacct.c

taskstats: Cleanup the use of task->exit_code

2022-02-23 11:58:39 +01:00

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-04-09 14:44:45 +08:00

uid16.c

…

uid16.h

…

umh.c

usermodehelper: reset umask to default before executing user process

2020-10-14 10:31:21 +02:00

up.c

smp: Fix smp_call_function_single_async prototype

2021-05-22 10:59:39 +02:00

user_namespace.c

…

user-return-notifier.c

…

user.c

…

utsname_sysctl.c

…

utsname.c

…

watchdog_hld.c

watchdog/perf: properly initialize the turbo mode timestamp and rearm counter

2024-08-19 05:32:05 +02:00

watchdog.c

watchdog: export lockup_detector_reconfigure

2022-08-25 11:15:46 +02:00

workqueue_internal.h

…

workqueue.c

workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()

2023-10-25 11:16:26 +02:00