linux-toradex.git/kernel/auditsc.c, branch v2.6.22.13

fix oops in __audit_signal_info()

2007-08-15T16:25:08+00:00

	Check for audit_signals is misplaced and check for
audit_dummy_context() is missing; as the result, if we send
signal to auditd from task with NULL ->audit_context while
we have audit_signals != 0 we end up with an oops.

Signed-off-by: Al Viro 
Acked-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Abnormal End of Processes

2007-05-11T09:38:26+00:00

Hi,

I have been working on some code that detects abnormal events based on audit
system events. One kind of event that we currently have no visibility for is
when a program terminates due to segfault - which should never happen on a
production machine. And if it did, you'd want to investigate it. Attached is a
patch that collects these events and sends them into the audit system.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] match audit name data

2007-05-11T09:38:26+00:00

Make more effort to detect previously collected names, so we don't log
multiple PATH records for a single filesystem object. Add
audit_inc_name_count() to reduce duplicate code.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] complete message queue auditing

2007-05-11T09:38:26+00:00

Handle the edge cases for POSIX message queue auditing. Collect inode
info when opening an existing mq, and for send/receive operations. Remove
audit_inode_update() as it has really evolved into the equivalent of
audit_inode().

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] initialize name osid

2007-05-11T09:38:25+00:00

Audit contexts can be reused, so initialize a name's osid to the
default in audit_getname(). This ensures we don't log a bogus object
label when no inode data is collected for a name.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] audit signal recipients

2007-05-11T09:38:25+00:00

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] auditing ptrace

2007-05-11T09:38:25+00:00

Signed-off-by: Al Viro

[PATCH] fix deadlock in audit_log_task_context()

2007-03-14T22:27:48+00:00

GFP_KERNEL allocations in non-blocking context; fixed by killing
an idiotic use of security_getprocattr().

Acked-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

[PATCH] AUDIT_FD_PAIR

2007-02-18T02:30:15+00:00

Provide an audit record of the descriptor pair returned by pipe() and
socketpair().  Rewritten from the original posted to linux-audit by
John D. Ramsdell 

Signed-off-by: Al Viro

[PATCH] struct path: convert kernel

2006-12-08T16:28:46+00:00

Signed-off-by: Josef Sipek 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds