linux-toradex.git/include/linux/audit.h, branch T20_LinuxImageV2.0Beta1_20121218

netfilter: add SELinux context support to AUDIT target

2011-06-30T11:31:57+00:00

In this revision the conversion of secid to SELinux context and adding it
to the audit log is moved from xt_AUDIT.c to audit.c with the aid of a
separate helper function - audit_log_secctx - which does both the conversion
and logging of SELinux context, thus also preventing internal secid number
being leaked to userspace. If conversion is not successful an error is raised.

With the introduction of this helper function the work done in xt_AUDIT.c is
much more simplified. It also opens the possibility of this helper function
being used by other modules (including auditd itself), if desired. With this
addition, typical (raw auditd) output after applying the patch would be:

type=NETFILTER_PKT msg=audit(1305852240.082:31012): action=0 hook=1 len=52 inif=? outif=eth0 saddr=10.1.1.7 daddr=10.1.2.1 ipid=16312 proto=6 sport=56150 dport=22 obj=system_u:object_r:ssh_client_packet_t:s0
type=NETFILTER_PKT msg=audit(1306772064.079:56): action=0 hook=3 len=48 inif=eth0 outif=? smac=00:05:5d:7c:27:0b dmac=00:02:b3:0a:7f:81 macproto=0x0800 saddr=10.1.2.1 daddr=10.1.1.7 ipid=462 proto=6 sport=22 dport=3561 obj=system_u:object_r:ssh_server_packet_t:s0

Acked-by: Eric Paris 
Signed-off-by: Mr Dash Four 
Signed-off-by: Patrick McHardy

Merge branch 'master' of /repos/git/net-next-2.6

2011-01-19T22:51:37+00:00

netfilter: create audit records for x_tables replaces

2011-01-16T17:12:59+00:00

The setsockopt() syscall to replace tables is already recorded
in the audit logs. This patch stores additional information
such as table name and netfilter protocol.

Cc: Patrick McHardy 
Cc: Eric Paris 
Cc: Al Viro 
Signed-off-by: Thomas Graf 
Signed-off-by: Patrick McHardy

netfilter: audit target to record accepted/dropped packets

2011-01-16T17:10:28+00:00

This patch adds a new netfilter target which creates audit records
for packets traversing a certain chain.

It can be used to record packets which are rejected administraively
as follows:

  -N AUDIT_DROP
  -A AUDIT_DROP -j AUDIT --type DROP
  -A AUDIT_DROP -j DROP

a rule which would typically drop or reject a packet would then
invoke the new chain to record packets before dropping them.

  -j AUDIT_DROP

The module is protocol independant and works for iptables, ip6tables
and ebtables.

The following information is logged:
 - netfilter hook
 - packet length
 - incomming/outgoing interface
 - MAC src/dst/proto for ethernet packets
 - src/dst/protocol address for IPv4/IPv6
 - src/dst port for TCP/UDP/UDPLITE
 - icmp type/code

Cc: Patrick McHardy 
Cc: Eric Paris 
Cc: Al Viro 
Signed-off-by: Thomas Graf 
Signed-off-by: Patrick McHardy

headers: path.h redux

2011-01-10T16:51:44+00:00

Remove path.h from sched.h and other files.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Linus Torvalds

audit mmap

2010-10-30T12:45:43+00:00

Normal syscall audit doesn't catch 5th argument of syscall.  It also
doesn't catch the contents of userland structures pointed to be
syscall argument, so for both old and new mmap(2) ABI it doesn't
record the descriptor we are mapping.  For old one it also misses
flags.

Signed-off-by: Al Viro

gcc-4.6: fs: fix unused but set warnings

2010-08-07T16:23:12+00:00

No real bugs I believe, just some dead code, and some
shut up code.

Signed-off-by: Andi Kleen 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: Jens Axboe

Lose the first argument of audit_inode_child()

2010-02-08T19:38:36+00:00

it's always equal to ->d_name.name of the second argument

Signed-off-by: Al Viro

Audit: clean up all op= output to include string quoting

2009-06-24T04:00:52+00:00

A number of places in the audit system we send an op= followed by a string
that includes spaces.  Somehow this works but it's just wrong.  This patch
moves all of those that I could find to be quoted.

Example:

Change From: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1
subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op=remove rule
key="number2" list=4 res=0

Change To: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1
subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="remove rule"
key="number2" list=4 res=0

Signed-off-by: Eric Paris

integrity: audit update

2009-02-11T22:40:14+00:00

Based on discussions on linux-audit, as per Steve Grubb's request
http://lkml.org/lkml/2009/2/6/269, the following changes were made:
- forced audit result to be either 0 or 1.
- made template names const
- Added new stand-alone message type: AUDIT_INTEGRITY_RULE

Signed-off-by: Mimi Zohar 
Acked-by: Steve Grubb 
Signed-off-by: James Morris