kernel/linux.git/include/linux/audit.h, branch linux-2.6.28.y

[PATCH] fix broken timestamps in AVC generated by kernel threads

2008-12-09T07:27:41+00:00

Timestamp in audit_context is valid only if ->in_syscall is set. Signed-off-by: Al Viro

[PATCH] return records for fork() both to child and parent

2008-12-09T07:27:38+00:00

Signed-off-by: Al Viro

remove the v850 port

2008-07-24T17:47:24+00:00

Trying to compile the v850 port brings many compile errors, one of them exists since at least kernel 2.6.19. There also seems to be noone willing to bring this port back into a usable state. This patch therefore removes the v850 port. If anyone ever decides to revive the v850 port the code will still be available from older kernels, and it wouldn't be impossible for the port to reenter the kernel if it would become actively maintained again. Signed-off-by: Adrian Bunk Acked-by: Greg Ungerer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] remove useless argument type in audit_filter_user()

2008-06-25T03:36:35+00:00

The second argument "type" is not used in audit_filter_user(), so I think that type can be removed. If I'm wrong, please tell me. Signed-off-by: Peng Haitao Signed-off-by: Al Viro

[PATCH] new predicate - AUDIT_FILETYPE

2008-04-28T10:28:37+00:00

Argument is S_IF... | , where index is normally 0 or 1. Triggers if chosen element of ctx->names[] is present and the mode of object in question matches the upper bits of argument. I.e. for things like "is the argument of that chmod a directory", etc. Signed-off-by: Al Viro

Audit: increase the maximum length of the key field

2008-04-28T10:19:29+00:00

Key lengths were arbitrarily limited to 32 characters. If userspace is going to start using the single kernel key field as multiple virtual key fields (example key=key1,key2,key3,key4) we should give them enough room to work. Signed-off-by: Eric Paris Signed-off-by: Al Viro

Audit: standardize string audit interfaces

2008-04-28T10:19:22+00:00

This patch standardized the string auditing interfaces. No userspace changes will be visible and this is all just cleanup and consistancy work. We have the following string audit interfaces to use: void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf, size_t len); void audit_log_n_string(struct audit_buffer *ab, const char *buf, size_t n); void audit_log_string(struct audit_buffer *ab, const char *buf); void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string, size_t n); void audit_log_untrustedstring(struct audit_buffer *ab, const char *string); This may be the first step to possibly fixing some of the issues that people have with the string output from the kernel audit system. But we still don't have an agreed upon solution to that problem. Signed-off-by: Eric Paris Signed-off-by: Al Viro

Audit: collect sessionid in netlink messages

2008-04-28T10:18:03+00:00

Previously I added sessionid output to all audit messages where it was available but we still didn't know the sessionid of the sender of netlink messages. This patch adds that information to netlink messages so we can audit who sent netlink messages. Signed-off-by: Eric Paris Signed-off-by: Al Viro

Audit: Final renamings and cleanup

2008-04-18T23:59:43+00:00

Rename the se_str and se_rule audit fields elements to lsm_str and lsm_rule to avoid confusion. Signed-off-by: Casey Schaufler Signed-off-by: Ahmed S. Darwish Acked-by: James Morris

SELinux: use new audit hooks, remove redundant exports

2008-04-18T23:53:46+00:00

Setup the new Audit LSM hooks for SELinux. Remove the now redundant exported SELinux Audit interface. Audit: Export 'audit_krule' and 'audit_field' to the public since their internals are needed by the implementation of the new LSM hook 'audit_rule_known'. Signed-off-by: Casey Schaufler Signed-off-by: Ahmed S. Darwish Acked-by: James Morris