audit: fix suffixed '/' filename matching
authorRicardo Robaina <rrobaina@redhat.com>
Fri, 22 Nov 2024 12:18:43 +0000 (09:18 -0300)
committerPaul Moore <paul@paul-moore.com>
Fri, 6 Dec 2024 00:22:38 +0000 (19:22 -0500)
commite92eebb0d6116f942ab25dfb1a41905aa59472a8
treea271cdb8eceaa471a62f0df342972fb881c0c8f2
parent40384c840ea1944d7c5a392e8975ed088ecf0b37
audit: fix suffixed '/' filename matching

When the user specifies a directory to delete with the suffix '/',
the audit record fails to collect the filename, resulting in the
following logs:

 type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=2 name=(null)
 type=PATH msg=audit(10/30/2024 14:11:17.796:6304) : item=1 name=(null)

It happens because the value of the variables dname, and n->name->name
in __audit_inode_child() differ only by the suffix '/'. This commit
treats this corner case by handling pathname's trailing slashes in
audit_compare_dname_path().

Steps to reproduce the issue:

 # auditctl -w /tmp
 $ mkdir /tmp/foo
 $ rm -r /tmp/foo/
 # ausearch -i | grep PATH | tail -3

The first version of this patch was based on a GitHub patch/PR by
user @hqh2010 [1].

Link: https://github.com/linux-audit/audit-kernel/pull/148
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: subject tweak, trim old metadata]
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/auditfilter.c