aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/audit.h
Commit message (Collapse)AuthorAgeFilesLines
* [PATCH] gfp_t: kernel/*Al Viro2005-10-281-2/+2
| | | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* Merge with /shiny/git/linux-2.6/.gitDavid Woodhouse2005-07-131-1/+1
|\
| * [SPARC64]: Add syscall auditing support.David S. Miller2005-07-101-1/+1
| | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | AUDIT: Fix definition of audit_log() if audit not enabledDavid Woodhouse2005-07-021-1/+1
| | | | | | | | | | | | | | audit_log() also takes an extra argument, although it's a vararg function so the compiler didn't really notice. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Fix definition of audit_log_start() if audit not enabledBadari Pulavarty2005-07-021-1/+1
| | | | | | | | | | | | | | | | | | | | audit_log_start() seems to take 3 arguments, but its defined to take only 2 when AUDIT is turned off. security/selinux/avc.c:553:75: macro "audit_log_start" passed 3 arguments, but takes just 2 Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Clean up user message filteringDavid Woodhouse2005-06-241-2/+3
| | | | | | | | | | | | | | | | Don't look up the task by its pid and then use the syscall filtering helper. Just implement our own filter helper which operates solely on the information in the netlink_skb_parms. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Wait for backlog to clear when generating messages.David Woodhouse2005-06-221-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a gfp_mask to audit_log_start() and audit_log(), to reduce the amount of GFP_ATOMIC allocation -- most of it doesn't need to be GFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to 60 seconds for the auditd backlog to clear instead of immediately abandoning the message. The timeout should probably be made configurable, but for now it'll suffice that it only happens if auditd is actually running. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Optimise the audit-disabled case for discarding user messagesDavid Woodhouse2005-06-221-3/+4
| | | | | | | | | | | | | | Also exempt USER_AVC message from being discarded to preserve existing behaviour for SE Linux. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Spawn kernel thread to list filter rules.David Woodhouse2005-06-211-0/+1
| | | | | | | | | | | | | | | | | | | | If we have enough rules to fill the netlink buffer space, it'll deadlock because auditctl isn't ever actually going to read from the socket until we return, and we aren't going to return until it reads... so we spawn a kernel thread to spew out the list and then exit. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Report lookup flags with path/inode records.David Woodhouse2005-06-201-2/+2
| | | | | | | | | | | | | | | | When LOOKUP_PARENT is used, the inode which results is not the inode found at the pathname. Report the flags so that this doesn't generate misleading audit records. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* | AUDIT: Allow filtering of user messagesDavid Woodhouse2005-06-191-4/+11
|/ | | | | | | | Turn the field from a bitmask to an enumeration and add a list to allow filtering of messages generated by userspace. We also define a list for file system watches in anticipation of that feature. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Record working directory when syscall arguments are pathnamesDavid Woodhouse2005-05-271-1/+2
| | | | Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Assign serial number to non-syscall messagesDavid Woodhouse2005-05-211-3/+4
| | | | | | | | | | | | Move audit_serial() into audit.c and use it to generate serial numbers on messages even when there is no audit context from syscall auditing. This allows us to disambiguate audit records when more than one is generated in the same millisecond. Based on a patch by Steve Grubb after he observed the problem. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Avoid sleeping function in SElinux AVC audit.Stephen Smalley2005-05-211-0/+3
| | | | | | | | | | This patch changes the SELinux AVC to defer logging of paths to the audit framework upon syscall exit, by saving a reference to the (dentry,vfsmount) pair in an auxiliary audit item on the current audit context for processing by audit_log_exit. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Treat all user messages identically.David Woodhouse2005-05-181-15/+2
| | | | | | | It's silly to have to add explicit entries for new userspace messages as we invent them. Just treat all messages in the user range the same. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Capture sys_socketcall arguments and sockaddrs David Woodhouse2005-05-171-1/+6
| | | | Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Fix some spelling errorsSteve Grubb2005-05-131-1/+1
| | | | | | | | I'm going through the kernel code and have a patch that corrects several spelling errors in comments. From: Steve Grubb <sgrubb@redhat.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Add message types to audit recordsSteve Grubb2005-05-131-16/+50
| | | | | | | | | | | | | | | | | This patch adds more messages types to the audit subsystem so that audit analysis is quicker, intuitive, and more useful. Signed-off-by: Steve Grubb <sgrubb@redhat.com> --- I forgot one type in the big patch. I need to add one for user space originating SE Linux avc messages. This is used by dbus and nscd. -Steve --- Updated to 2.6.12-rc4-mm1. -dwmw2 Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* Add audit_log_typeChris Wright2005-05-111-6/+10
| | | | | | | | | | | | | | Add audit_log_type to allow callers to specify type and pid when logging. Convert audit_log to wrapper around audit_log_type. Could have converted all audit_log callers directly, but common case is default of type AUDIT_KERNEL and pid 0. Update audit_log_start to take type and pid values when creating a new audit_buffer. Move sequences that did audit_log_start, audit_log_format, audit_set_type, audit_log_end, to simply call audit_log_type directly. This obsoletes audit_set_type and audit_set_pid, so remove them. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* Move ifdef CONFIG_AUDITSYSCALL to headerChris Wright2005-05-111-1/+3
| | | | | | | | Remove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c. Move these dependencies to audit.h with the rest. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* The attached patch addresses the problem with getting the audit daemon Steve Grubb2005-05-061-8/+17
| | | | | | | | | | | | | | | | | | | | | | | shutdown credential information. It creates a new message type AUDIT_TERM_INFO, which is used by the audit daemon to query who issued the shutdown. It requires the placement of a hook function that gathers the information. The hook is after the DAC & MAC checks and before the function returns. Racing threads could overwrite the uid & pid - but they would have to be root and have policy that allows signalling the audit daemon. That should be a manageable risk. The userspace component will be released later in audit 0.7.2. When it receives the TERM signal, it queries the kernel for shutdown information. When it receives it, it writes the message and exits. The message looks like this: type=DAEMON msg=auditd(1114551182.000) auditd normal halt, sending pid=2650 uid=525, auditd pid=1685 Signed-off-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* [AUDIT] LOGIN message credentialsSteve Grubb2005-04-291-1/+1
| | | | | | | | | | | | Attached is a new patch that solves the issue of getting valid credentials into the LOGIN message. The current code was assuming that the audit context had already been copied. This is not always the case for LOGIN messages. To solve the problem, the patch passes the task struct to the function that emits the message where it can get valid credentials. Signed-off-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* Add audit uid to netlink credentialsSerge Hallyn2005-04-291-1/+1
| | | | | | | | | | Most audit control messages are sent over netlink.In order to properly log the identity of the sender of audit control messages, we would like to add the loginuid to the netlink_creds structure, as per the attached patch. Signed-off-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* audit: update pointer to userspace tools, remove emacs mode tags2005-04-291-1/+1
|
* [AUDIT] Fix signedness of 'serial' in various routines.Steve Grubb2005-04-291-1/+1
| | | | | | | | | | Attached is a patch that corrects a signed/unsigned warning. I also noticed that we needlessly init serial to 0. That only needs to occur if the kernel was compiled without the audit system. -Steve Grubb Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* [AUDIT] Don't allow ptrace to fool auditing, log arch of audited syscalls.2005-04-291-4/+44
| | | | | | | | | | | | | | | | | | We were calling ptrace_notify() after auditing the syscall and arguments, but the debugger could have _changed_ them before the syscall was actually invoked. Reorder the calls to fix that. While we're touching ever call to audit_syscall_entry(), we also make it take an extra argument: the architecture of the syscall which was made, because some architectures allow more than one type of syscall. Also add an explicit success/failure flag to audit_syscall_exit(), for the benefit of architectures which return that in a condition register rather than only returning a single register. Change type of syscall return value to 'long' not 'int'. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* AUDIT: Avoid log pollution by untrusted strings.2005-04-291-1/+7
| | | | | | | | | | We log strings from userspace, such as arguments to open(). These could be formatted to contain \n followed by fake audit log entries. Provide a function for logging such strings, which gives a hex dump when the string contains anything but basic printable ASCII characters. Use it for logging filenames. Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* Linux-2.6.12-rc2Linus Torvalds2005-04-161-0/+196
Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
generated by cgit v1.1 at 2024-11-01 03:46:14 +0000