linux-toradex.git/include/linux/audit.h, branch v2.6.22.3

[PATCH] Abnormal End of Processes

2007-05-11T09:38:26+00:00

Hi,

I have been working on some code that detects abnormal events based on audit
system events. One kind of event that we currently have no visibility for is
when a program terminates due to segfault - which should never happen on a
production machine. And if it did, you'd want to investigate it. Attached is a
patch that collects these events and sends them into the audit system.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] complete message queue auditing

2007-05-11T09:38:26+00:00

Handle the edge cases for POSIX message queue auditing. Collect inode
info when opening an existing mq, and for send/receive operations. Remove
audit_inode_update() as it has really evolved into the equivalent of
audit_inode().

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] audit signal recipients

2007-05-11T09:38:25+00:00

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] add SIGNAL syscall class (v3)

2007-05-11T09:38:25+00:00

Add a syscall class for sending signals.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] auditing ptrace

2007-05-11T09:38:25+00:00

Signed-off-by: Al Viro

[PATCH] linux/audit.h needs linux/types.h

2007-03-06T17:30:25+00:00

Include linux/types.h here because we need a definition of __u32.  This file
appears not be exported verbatim by libc, so I think this doesn't have any
userspace consequences.

Signed-off-by: Jeff Dike 
Cc: Paolo 'Blaisorblade' Giarrusso 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] AUDIT_FD_PAIR

2007-02-18T02:30:15+00:00

Provide an audit record of the descriptor pair returned by pipe() and
socketpair().  Rewritten from the original posted to linux-audit by
John D. Ramsdell 

Signed-off-by: Al Viro

audit: Add auditing to ipsec

2006-12-07T04:14:22+00:00

An audit message occurs when an ipsec SA
or ipsec policy is created/deleted.

Signed-off-by: Joy Latten 
Signed-off-by: James Morris 
Signed-off-by: David S. Miller

[PATCH] message types updated

2006-10-04T12:31:24+00:00

Hi,

This patch adds a new type for 3rd party module use and cleans up a deprecated
message type.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[NetLabel]: audit fixups due to delayed feedback

2006-09-30T00:05:05+00:00

Fix some issues Steve Grubb had with the way NetLabel was using the audit
subsystem.  This should make NetLabel more consistent with other kernel
generated audit messages specifying configuration changes.

Signed-off-by: Paul Moore 
Acked-by: Steve Grubb 
Signed-off-by: David S. Miller