linux-toradex.git/include/linux/audit.h, branch v2.6.16.15

[PATCH] gfp_t: kernel/*

2005-10-28T15:16:49+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

Merge with /shiny/git/linux-2.6/.git

2005-07-13T14:25:59+00:00

[SPARC64]: Add syscall auditing support.

2005-07-11T02:29:45+00:00

Signed-off-by: David S. Miller

AUDIT: Fix definition of audit_log() if audit not enabled

2005-07-02T12:50:40+00:00

audit_log() also takes an extra argument, although it's a vararg 
function so the compiler didn't really notice.

Signed-off-by: David Woodhouse

AUDIT: Fix definition of audit_log_start() if audit not enabled

2005-07-02T12:49:07+00:00

audit_log_start() seems to take 3 arguments, but its defined to take 
only 2 when AUDIT is turned off.

security/selinux/avc.c:553:75: macro "audit_log_start" passed 3 arguments, but takes just 2

Signed-off-by: Andrew Morton 
Signed-off-by: David Woodhouse

AUDIT: Clean up user message filtering

2005-06-24T13:14:05+00:00

Don't look up the task by its pid and then use the syscall filtering
helper. Just implement our own filter helper which operates solely on
the information in the netlink_skb_parms. 

Signed-off-by: David Woodhouse

AUDIT: Wait for backlog to clear when generating messages.

2005-06-22T14:04:33+00:00

Add a gfp_mask to audit_log_start() and audit_log(), to reduce the
amount of GFP_ATOMIC allocation -- most of it doesn't need to be 
GFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to
60 seconds for the auditd backlog to clear instead of immediately 
abandoning the message. 

The timeout should probably be made configurable, but for now it'll 
suffice that it only happens if auditd is actually running.

Signed-off-by: David Woodhouse

AUDIT: Optimise the audit-disabled case for discarding user messages

2005-06-22T13:56:47+00:00

Also exempt USER_AVC message from being discarded to preserve 
existing behaviour for SE Linux.

Signed-off-by: David Woodhouse

AUDIT: Spawn kernel thread to list filter rules.

2005-06-21T15:22:01+00:00

If we have enough rules to fill the netlink buffer space, it'll 
deadlock because auditctl isn't ever actually going to read from the 
socket until we return, and we aren't going to return until it 
reads... so we spawn a kernel thread to spew out the list and then
exit.

Signed-off-by: David Woodhouse

AUDIT: Report lookup flags with path/inode records.

2005-06-20T15:11:05+00:00

When LOOKUP_PARENT is used, the inode which results is not the inode
found at the pathname. Report the flags so that this doesn't generate
misleading audit records.

Signed-off-by: David Woodhouse