Re: [PATCH] audit: handle unknown status requests in audit_receive_msg

On Fri, Mar 6, 2026 at 12:22 AM Paul Moore <[email protected]> wrote:
>
> On Tue, Mar 3, 2026 at 7:42 AM Ricardo Robaina <[email protected]> wrote:
> >
> > Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET
> > requests, incorrectly returning success to newer user space tools
> > querying unsupported features. This breaks forward compatibility.
> >
> > Fix this by defining AUDIT_STATUS_ALL in the UAPI header and returning
> > -EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL).
> > This ensures invalid requests are safely rejected, allowing user space
> > to reliably test for and gracefully handle feature detection on older
> > kernels.
> >
> > Suggested-by: Steve Grubb <[email protected]>
> > Signed-off-by: Ricardo Robaina <[email protected]>
> > ---
> >  include/uapi/linux/audit.h | 9 +++++++++
> >  kernel/audit.c             | 2 ++
> >  2 files changed, 11 insertions(+)
> >
> > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> > index 14a1c1fe013a..1d5122b9274a 100644
> > --- a/include/uapi/linux/audit.h
> > +++ b/include/uapi/linux/audit.h
> > @@ -356,6 +356,15 @@ enum {
> >  #define AUDIT_STATUS_LOST                      0x0040
> >  #define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL  0x0080
> >
> > +#define AUDIT_STATUS_ALL (AUDIT_STATUS_ENABLED | \
> > +                         AUDIT_STATUS_FAILURE | \
> > +                         AUDIT_STATUS_PID | \
> > +                         AUDIT_STATUS_RATE_LIMIT | \
> > +                         AUDIT_STATUS_BACKLOG_LIMIT | \
> > +                         AUDIT_STATUS_BACKLOG_WAIT_TIME | \
> > +                         AUDIT_STATUS_LOST | \
> > +                         AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL)
>
> Overall I think this is fine and good, but AUDIT_STATUS_ALL doesn't
> need to be in the UAPI so why don't we move it to
> include/linux/audit.h?  You can put it at the very top, right above
> the AUDIT_INO_UNSET macro.
>

Thanks for reviewing this patch, Paul! Sounds like a good idea, I'll
work on the V2.

> >  #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT     0x00000001
> >  #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
> >  #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH   0x00000004
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index 5a0216056524..592383dce090 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -1295,6 +1295,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
> >                 memset(&s, 0, sizeof(s));
> >                 /* guard against past and future API changes */
> >                 memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
> > +               if (s.mask & ~AUDIT_STATUS_ALL)
> > +                       return -EINVAL;
> >                 if (s.mask & AUDIT_STATUS_ENABLED) {
> >                         err = audit_set_enabled(s.enabled);
> >                         if (err < 0)
> > --
> > 2.53.0
>
> --
> paul-moore.com
>