kernel.git/include/linux/audit.h, branch linux-2.6.18.y

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30Z

add support for AUDIT_PERM predicate Signed-off-by: Al Viro

[PATCH] audit: more syscall classes added

2006-09-11T17:32:27Z

Signed-off-by: Al Viro

[PATCH] don't bother with aux entires for dummy context

2006-08-03T14:59:42Z

Signed-off-by: Al Viro

[PATCH] mark context of syscall entered with no rules as dummy

2006-08-03T14:59:26Z

Signed-off-by: Al Viro

[PATCH] introduce audit rules counter

2006-08-03T14:55:18Z

Signed-off-by: Al Viro

[PATCH] fix missed create event for directory audit

2006-08-03T14:50:30Z

When an object is created via a symlink into an audited directory, audit misses the event due to not having collected the inode data for the directory. Modify __audit_inode_child() to copy the parent inode data if a parent wasn't found in audit_names[]. Signed-off-by: Amy Griffis Signed-off-by: Al Viro

[PATCH] fix faulty inode data collection for open() with O_CREAT

2006-08-03T14:50:21Z

When the specified path is an existing file or when it is a symlink, audit collects the wrong inode number, which causes it to miss the open() event. Adding a second hook to the open() path fixes this. Also add audit_copy_inode() to consolidate some code. Signed-off-by: Amy Griffis Signed-off-by: Al Viro

[PATCH] audit syscall classes

2006-07-01T11:44:10Z

Allow to tie upper bits of syscall bitmap in audit rules to kernel-defined sets of syscalls. Infrastructure, a couple of classes (with 32bit counterparts for biarch targets) and actual tie-in on i386, amd64 and ia64. Signed-off-by: Al Viro

[PATCH] audit: rename AUDIT_SE_* constants

2006-07-01T09:44:08Z

This patch renames some audit constant definitions and adds additional definitions used by the following patch. The renaming avoids ambiguity with respect to the new definitions. Signed-off-by: Darrel Goeddel include/linux/audit.h | 15 ++++++++---- kernel/auditfilter.c | 50 ++++++++++++++++++++--------------------- kernel/auditsc.c | 10 ++++---- security/selinux/ss/services.c | 32 +++++++++++++------------- 4 files changed, 56 insertions(+), 51 deletions(-) Signed-off-by: Al Viro

[PATCH] add rule filterkey

2006-07-01T09:43:06Z

Add support for a rule key, which can be used to tie audit records to audit rules. This is useful when a watched file is accessed through a link or symlink, as well as for general audit log analysis. Because this patch uses a string key instead of an integer key, there is a bit of extra overhead to do the kstrdup() when a rule fires. However, we're also allocating memory for the audit record buffer, so it's probably not that significant. I went ahead with a string key because it seems more user-friendly. Note that the user must ensure that filterkeys are unique. The kernel only checks for duplicate rules. Signed-off-by: Amy Griffis