linux-stable.git/kernel/auditsc.c, branch linux-2.6.18.y

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30+00:00

add support for AUDIT_PERM predicate

Signed-off-by: Al Viro

[PATCH] take filling ->pid, etc. out of audit_get_context()

2006-08-03T14:59:51+00:00

move that stuff downstream and into the only branch where it'll be
used.

Signed-off-by: Al Viro

[PATCH] don't bother with aux entires for dummy context

2006-08-03T14:59:42+00:00

Signed-off-by: Al Viro

[PATCH] mark context of syscall entered with no rules as dummy

2006-08-03T14:59:26+00:00

Signed-off-by: Al Viro

[PATCH] introduce audit rules counter

2006-08-03T14:55:18+00:00

Signed-off-by: Al Viro

[PATCH] fix missed create event for directory audit

2006-08-03T14:50:30+00:00

When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] fix faulty inode data collection for open() with O_CREAT

2006-08-03T14:50:21+00:00

When the specified path is an existing file or when it is a symlink, audit
collects the wrong inode number, which causes it to miss the open() event.
Adding a second hook to the open() path fixes this.

Also add audit_copy_inode() to consolidate some code.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] audit: support for object context filters

2006-07-01T09:44:19+00:00

This patch introduces object audit filters based on the elements
of the SELinux context.

Signed-off-by: Darrel Goeddel 
Acked-by:  Stephen Smalley 

 kernel/auditfilter.c           |   25 +++++++++++++++++++++++++
 kernel/auditsc.c               |   40 ++++++++++++++++++++++++++++++++++++++++
 security/selinux/ss/services.c |   18 +++++++++++++++++-
 3 files changed, 82 insertions(+), 1 deletion(-)
Signed-off-by: Al Viro

[PATCH] audit: rename AUDIT_SE_* constants

2006-07-01T09:44:08+00:00

This patch renames some audit constant definitions and adds
additional definitions used by the following patch.  The renaming
avoids ambiguity with respect to the new definitions.

Signed-off-by: Darrel Goeddel 

 include/linux/audit.h          |   15 ++++++++----
 kernel/auditfilter.c           |   50 ++++++++++++++++++++---------------------
 kernel/auditsc.c               |   10 ++++----
 security/selinux/ss/services.c |   32 +++++++++++++-------------
 4 files changed, 56 insertions(+), 51 deletions(-)
Signed-off-by: Al Viro

[PATCH] add rule filterkey

2006-07-01T09:43:06+00:00

Add support for a rule key, which can be used to tie audit records to audit
rules.  This is useful when a watched file is accessed through a link or
symlink, as well as for general audit log analysis.

Because this patch uses a string key instead of an integer key, there is a bit
of extra overhead to do the kstrdup() when a rule fires.  However, we're also
allocating memory for the audit record buffer, so it's probably not that
significant.  I went ahead with a string key because it seems more
user-friendly.

Note that the user must ensure that filterkeys are unique.  The kernel only
checks for duplicate rules.

Signed-off-by: Amy Griffis