linux-toradex.git/include/linux/audit.h, branch v2.6.18.8

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30+00:00

add support for AUDIT_PERM predicate

Signed-off-by: Al Viro

[PATCH] audit: more syscall classes added

2006-09-11T17:32:27+00:00

Signed-off-by: Al Viro

[PATCH] don't bother with aux entires for dummy context

2006-08-03T14:59:42+00:00

Signed-off-by: Al Viro

[PATCH] mark context of syscall entered with no rules as dummy

2006-08-03T14:59:26+00:00

Signed-off-by: Al Viro

[PATCH] introduce audit rules counter

2006-08-03T14:55:18+00:00

Signed-off-by: Al Viro

[PATCH] fix missed create event for directory audit

2006-08-03T14:50:30+00:00

When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] fix faulty inode data collection for open() with O_CREAT

2006-08-03T14:50:21+00:00

When the specified path is an existing file or when it is a symlink, audit
collects the wrong inode number, which causes it to miss the open() event.
Adding a second hook to the open() path fixes this.

Also add audit_copy_inode() to consolidate some code.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] audit syscall classes

2006-07-01T11:44:10+00:00

Allow to tie upper bits of syscall bitmap in audit rules to kernel-defined
sets of syscalls.  Infrastructure, a couple of classes (with 32bit counterparts
for biarch targets) and actual tie-in on i386, amd64 and ia64.

Signed-off-by: Al Viro

[PATCH] audit: rename AUDIT_SE_* constants

2006-07-01T09:44:08+00:00

This patch renames some audit constant definitions and adds
additional definitions used by the following patch.  The renaming
avoids ambiguity with respect to the new definitions.

Signed-off-by: Darrel Goeddel 

 include/linux/audit.h          |   15 ++++++++----
 kernel/auditfilter.c           |   50 ++++++++++++++++++++---------------------
 kernel/auditsc.c               |   10 ++++----
 security/selinux/ss/services.c |   32 +++++++++++++-------------
 4 files changed, 56 insertions(+), 51 deletions(-)
Signed-off-by: Al Viro

[PATCH] add rule filterkey

2006-07-01T09:43:06+00:00

Add support for a rule key, which can be used to tie audit records to audit
rules.  This is useful when a watched file is accessed through a link or
symlink, as well as for general audit log analysis.

Because this patch uses a string key instead of an integer key, there is a bit
of extra overhead to do the kstrdup() when a rule fires.  However, we're also
allocating memory for the audit record buffer, so it's probably not that
significant.  I went ahead with a string key because it seems more
user-friendly.

Note that the user must ensure that filterkeys are unique.  The kernel only
checks for duplicate rules.

Signed-off-by: Amy Griffis