kernel.git/include/linux/audit.h, branch linux-2.6.13.y

[SPARC64]: Add syscall auditing support.

2005-07-11T02:29:45Z

Signed-off-by: David S. Miller

AUDIT: Record working directory when syscall arguments are pathnames

2005-05-27T11:17:28Z

Signed-off-by: David Woodhouse

AUDIT: Assign serial number to non-syscall messages

2005-05-21T20:08:09Z

Move audit_serial() into audit.c and use it to generate serial numbers on messages even when there is no audit context from syscall auditing. This allows us to disambiguate audit records when more than one is generated in the same millisecond. Based on a patch by Steve Grubb after he observed the problem. Signed-off-by: David Woodhouse

AUDIT: Avoid sleeping function in SElinux AVC audit.

2005-05-20T23:15:52Z

This patch changes the SELinux AVC to defer logging of paths to the audit framework upon syscall exit, by saving a reference to the (dentry,vfsmount) pair in an auxiliary audit item on the current audit context for processing by audit_log_exit. Signed-off-by: Stephen Smalley Signed-off-by: David Woodhouse

AUDIT: Treat all user messages identically.

2005-05-18T09:21:07Z

It's silly to have to add explicit entries for new userspace messages as we invent them. Just treat all messages in the user range the same. Signed-off-by: David Woodhouse

AUDIT: Capture sys_socketcall arguments and sockaddrs

2005-05-17T11:08:48Z

Signed-off-by: David Woodhouse

AUDIT: Fix some spelling errors

2005-05-13T17:35:15Z

I'm going through the kernel code and have a patch that corrects several spelling errors in comments. From: Steve Grubb Signed-off-by: David Woodhouse

AUDIT: Add message types to audit records

2005-05-13T17:17:42Z

This patch adds more messages types to the audit subsystem so that audit analysis is quicker, intuitive, and more useful. Signed-off-by: Steve Grubb --- I forgot one type in the big patch. I need to add one for user space originating SE Linux avc messages. This is used by dbus and nscd. -Steve --- Updated to 2.6.12-rc4-mm1. -dwmw2 Signed-off-by: David Woodhouse

Add audit_log_type

2005-05-11T09:55:10Z

Add audit_log_type to allow callers to specify type and pid when logging. Convert audit_log to wrapper around audit_log_type. Could have converted all audit_log callers directly, but common case is default of type AUDIT_KERNEL and pid 0. Update audit_log_start to take type and pid values when creating a new audit_buffer. Move sequences that did audit_log_start, audit_log_format, audit_set_type, audit_log_end, to simply call audit_log_type directly. This obsoletes audit_set_type and audit_set_pid, so remove them. Signed-off-by: Chris Wright Signed-off-by: David Woodhouse

Move ifdef CONFIG_AUDITSYSCALL to header

2005-05-11T09:54:05Z

Remove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c. Move these dependencies to audit.h with the rest. Signed-off-by: Chris Wright Signed-off-by: David Woodhouse