kernel.git/include/uapi/linux/audit.h, branch linux-3.7.yHosts the 0x221E linux distro kernel.
https://git.0xinfinity.dev/distro/kernel.git/atom?h=linux-3.7.y2013-01-17T16:46:22Zaudit: create explicit AUDIT_SECCOMP event type2013-01-17T16:46:22ZKees Cook2013-01-11T22:32:05Zurn:sha1:2edbcdd71ca6c7751171221a559efcc3694c3694
commit 7b9205bd775afc4439ed86d617f9042ee9e76a71 upstream.
The seccomp path was using AUDIT_ANOM_ABEND from when seccomp mode 1
could only kill a process. While we still want to make sure an audit
record is forced on a kill, this should use a separate record type since
seccomp mode 2 introduces other behaviors.
In the case of "handled" behaviors (process wasn't killed), only emit a
record if the process is under inspection. This change also fixes
userspace examination of seccomp audit events, since it was considered
malformed due to missing fields of the AUDIT_ANOM_ABEND event type.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jeff Layton <jlayton@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Julien Tinnes <jln@google.com>
Acked-by: Will Drewry <wad@chromium.org>
Acked-by: Steve Grubb <sgrubb@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
UAPI: (Scripted) Disintegrate include/linux2012-10-13T09:46:48ZDavid Howells2012-10-13T09:46:48Zurn:sha1:607ca46e97a1b6594b29647d98a32d545c24bdff
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>