linux-toradex.git/include/linux/audit.h, branch v3.6.4

fs: add link restriction audit reporting

2012-07-29T17:43:08+00:00

Adds audit messages for unexpected link restriction violations so that
system owners will have some sort of potentially actionable information
about misbehaving processes.

Signed-off-by: Kees Cook 
Signed-off-by: Al Viro

seccomp: remove duplicated failure logging

2012-04-14T01:13:20+00:00

This consolidates the seccomp filter error logging path and adds more
details to the audit log.

Signed-off-by: Will Drewry 
Signed-off-by: Kees Cook 
Acked-by: Eric Paris 

v18: make compat= permanent in the record
v15: added a return code to the audit_seccomp path by wad@chromium.org
     (suggested by eparis@redhat.com)
v*: original by keescook@chromium.org
Signed-off-by: James Morris

constify path argument of audit_log_d_path()

2012-03-21T01:29:40+00:00

Signed-off-by: Al Viro

audit: comparison on interprocess fields

2012-01-17T21:17:03+00:00

This allows audit to specify rules in which we compare two fields of a
process.  Such as is the running process uid != to the running process
euid?

Signed-off-by: Peter Moody 
Signed-off-by: Eric Paris

audit: implement all object interfield comparisons

2012-01-17T21:17:02+00:00

This completes the matrix of interfield comparisons between uid/gid
information for the current task and the uid/gid information for inodes.
aka I can audit based on differences between the euid of the process and
the uid of fs objects.

Signed-off-by: Peter Moody 
Signed-off-by: Eric Paris

audit: allow interfield comparison between gid and ogid

2012-01-17T21:17:02+00:00

Allow audit rules to compare the gid of the running task to the gid of the
inode in question.

Signed-off-by: Eric Paris

audit: allow interfield comparison in audit rules

2012-01-17T21:17:01+00:00

We wish to be able to audit when a uid=500 task accesses a file which is
uid=0.  Or vice versa.  This patch introduces a new audit filter type
AUDIT_FIELD_COMPARE which takes as an 'enum' which indicates which fields
should be compared.  At this point we only define the task->uid vs
inode->uid, but other comparisons can be added.

Signed-off-by: Eric Paris

audit: remove task argument to audit_set_loginuid

2012-01-17T21:17:00+00:00

The function always deals with current.  Don't expose an option
pretending one can use it for something.  You can't.

Signed-off-by: Eric Paris

audit: allow audit matching on inode gid

2012-01-17T21:16:59+00:00

Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris

audit: allow matching on obj_uid

2012-01-17T21:16:59+00:00

Allow syscall exit filter matching based on the uid of the owner of an
inode used in a syscall.  aka:

auditctl -a always,exit -S open -F obj_uid=0 -F perm=wa

Signed-off-by: Eric Paris