audit: use task_tgid_nr() instead of task_pid_nr()
authorRicardo Robaina <rrobaina@redhat.com>
Wed, 28 Aug 2024 11:25:06 +0000 (08:25 -0300)
committerPaul Moore <paul@paul-moore.com>
Wed, 28 Aug 2024 20:48:28 +0000 (16:48 -0400)
commit61c60977926e15716f469577797cd86d0369cbaa
tree0975824921e24fff52b27855c82f52632725f8c5
parent8400291e289ee6b2bf9779ff1c83a291501f017b
audit: use task_tgid_nr() instead of task_pid_nr()

In a few audit records, PIDs were being recorded with task_pid_nr()
instead of task_tgid_nr().

$ grep "task_pid_nr" kernel/audit*.c
audit.c:       task_pid_nr(current),
auditfilter.c: pid = task_pid_nr(current);
auditsc.c:     audit_log_format(ab, " pid=%u", task_pid_nr(current));

For single-thread applications, the process id (pid) and the thread
group id (tgid) are the same. However, on multi-thread applications,
task_pid_nr() returns the current thread id (user-space's TID), while
task_tgid_nr() returns the main thread id (user-space's PID). Since
the users are more interested in the process id (pid), rather than the
thread id (tid), this patch converts these callers to the correct method.

Link: https://github.com/linux-audit/audit-kernel/issues/126
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit.c
kernel/auditfilter.c
kernel/auditsc.c