From 16bec31db751030171b31d7767fa3a5bdbe980ea Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Wed, 7 Mar 2007 16:02:16 -0800 Subject: [IPSEC]: xfrm audit hook misplaced in pfkey_delete and xfrm_del_sa Inside pfkey_delete and xfrm_del_sa the audit hooks were not called if there was any permission/security failures in attempting to do the del operation (such as permission denied from security_xfrm_state_delete). This patch moves the audit hook to the exit path such that all failures (and successes) will actually get audited. Signed-off-by: Eric Paris Acked-by: Venkat Yekkirala Acked-by: James Morris Signed-off-by: David S. Miller --- net/key/af_key.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'net/key') diff --git a/net/key/af_key.c b/net/key/af_key.c index 1a2bd5f88b7..a4e7e2db0ff 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1467,9 +1467,6 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h err = xfrm_state_delete(x); - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); - if (err < 0) goto out; @@ -1478,6 +1475,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h c.event = XFRM_MSG_DELSA; km_state_notify(x, &c); out: + xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, + AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); xfrm_state_put(x); return err; -- cgit v1.2.3