linux-toradex.git/include/linux/audit.h, branch v3.3.5

audit: comparison on interprocess fields

2012-01-17T21:17:03+00:00

This allows audit to specify rules in which we compare two fields of a
process.  Such as is the running process uid != to the running process
euid?

Signed-off-by: Peter Moody 
Signed-off-by: Eric Paris

audit: implement all object interfield comparisons

2012-01-17T21:17:02+00:00

This completes the matrix of interfield comparisons between uid/gid
information for the current task and the uid/gid information for inodes.
aka I can audit based on differences between the euid of the process and
the uid of fs objects.

Signed-off-by: Peter Moody 
Signed-off-by: Eric Paris

audit: allow interfield comparison between gid and ogid

2012-01-17T21:17:02+00:00

Allow audit rules to compare the gid of the running task to the gid of the
inode in question.

Signed-off-by: Eric Paris

audit: allow interfield comparison in audit rules

2012-01-17T21:17:01+00:00

We wish to be able to audit when a uid=500 task accesses a file which is
uid=0.  Or vice versa.  This patch introduces a new audit filter type
AUDIT_FIELD_COMPARE which takes as an 'enum' which indicates which fields
should be compared.  At this point we only define the task->uid vs
inode->uid, but other comparisons can be added.

Signed-off-by: Eric Paris

audit: remove task argument to audit_set_loginuid

2012-01-17T21:17:00+00:00

The function always deals with current.  Don't expose an option
pretending one can use it for something.  You can't.

Signed-off-by: Eric Paris

audit: allow audit matching on inode gid

2012-01-17T21:16:59+00:00

Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris

audit: allow matching on obj_uid

2012-01-17T21:16:59+00:00

Allow syscall exit filter matching based on the uid of the owner of an
inode used in a syscall.  aka:

auditctl -a always,exit -S open -F obj_uid=0 -F perm=wa

Signed-off-by: Eric Paris

audit: remove audit_finish_fork as it can't be called

2012-01-17T21:16:59+00:00

Audit entry,always rules are not allowed and are automatically changed in
exit,always rules in userspace.  The kernel refuses to load such rules.

Thus a task in the middle of a syscall (and thus in audit_finish_fork())
can only be in one of two states: AUDIT_BUILD_CONTEXT or AUDIT_DISABLED.
Since the current task cannot be in AUDIT_RECORD_CONTEXT we aren't every
going to actually use the code in audit_finish_fork() since it will
return without doing anything.  Thus drop the code.

Signed-off-by: Eric Paris

audit: inline audit_free to simplify the look of generic code

2012-01-17T21:16:58+00:00

make the conditional a static inline instead of doing it in generic code.

Signed-off-by: Eric Paris

audit: drop audit_set_macxattr as it doesn't do anything

2012-01-17T21:16:58+00:00

unused.  deleted.

Signed-off-by: Eric Paris