linux-toradex.git/security/apparmor/audit.c, branch v3.13.5

apparmor: remove parent task info from audit logging

2013-10-30T04:34:04+00:00

The reporting of the parent task info is a vestage from old versions of
apparmor. The need for this information was removed by unique null-
profiles before apparmor was upstreamed so remove this info from logging.

Signed-off-by: John Johansen

apparmor: remove tsk field from the apparmor_audit_struct

2013-10-30T04:33:52+00:00

Now that aa_capabile no longer sets the task field it can be removed
and the lsm_audit version of the field can be used.

Signed-off-by: John Johansen

apparmor: fix the audit type table

2013-04-28T07:37:41+00:00

The audit type table is missing a comma so that KILLED comes out as
KILLEDAUTO.

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: move task from common_audit_data to apparmor_audit_data

2012-04-09T16:23:02+00:00

apparmor is the only LSM that uses the common_audit_data tsk field.
Instead of making all LSMs pay for the stack space move the aa usage into
the apparmor_audit_data.

Signed-off-by: Eric Paris

lsm_audit: don't specify the audit pre/post callbacks in 'struct common_audit_data'

2012-04-03T16:49:59+00:00

It just bloats the audit data structure for no good reason, since the
only time those fields are filled are just before calling the
common_lsm_audit() function, which is also the only user of those
fields.

So just make them be the arguments to common_lsm_audit(), rather than
bloating that structure that is passed around everywhere, and is
initialized in hot paths.

Signed-off-by: Linus Torvalds

LSM: shrink sizeof LSM specific portion of common_audit_data

2012-04-03T16:48:40+00:00

Linus found that the gigantic size of the common audit data caused a big
perf hit on something as simple as running stat() in a loop.  This patch
requires LSMs to declare the LSM specific portion separately rather than
doing it in a union.  Thus each LSM can be responsible for shrinking their
portion and don't have to pay a penalty just because other LSMs have a
bigger space requirement.

Signed-off-by: Eric Paris 
Signed-off-by: Linus Torvalds

AppArmor: add const qualifiers to string arrays

2012-03-15T02:09:13+00:00

Signed-off-by: Jan Engelhardt 
Signed-off-by: John Johansen

AppArmor: Fix dropping of allowed operations that are force audited

2012-02-27T19:38:21+00:00

The audit permission flag, that specifies an audit message should be
provided when an operation is allowed, was being ignored in some cases.

This is because the auto audit mode (which determines the audit mode from
system flags) was incorrectly assigned the same value as audit mode. The
shared value would result in messages that should be audited going through
a second evaluation as to whether they should be audited based on the
auto audit, resulting in some messages being dropped.

Signed-off-by: John Johansen 
Acked-by: Kees Cook

apparmor: add missing rcu_dereference()

2011-12-09T01:08:41+00:00

Adds a missed rcu_dereference() around real_parent.

Signed-off-by: Kees Cook 
Acked-by: John Johansen 
Signed-off-by: James Morris

AppArmor: basic auditing infrastructure.

2010-08-02T05:35:11+00:00

Update lsm_audit for AppArmor specific data, and add the core routines for
AppArmor uses for auditing.

Signed-off-by: John Johansen 
Signed-off-by: James Morris