kernel.git/kernel/auditfilter.c, branch linux-2.6.20.y

[PATCH] audit: fix oops removing watch if audit disabled

2007-08-15T08:02:32Z

Removing a watched file will oops if audit is disabled (auditctl -e 0). To reproduce: - auditctl -e 1 - touch /tmp/foo - auditctl -w /tmp/foo - auditctl -e 0 - rm /tmp/foo (or mv) Signed-off-by: Tony Jones Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] audit: fix kstrdup() error check

2006-12-22T16:55:49Z

kstrdup() returns NULL on error. Cc: David Woodhouse Signed-off-by: Akinobu Mita Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] kernel core: replace kmalloc+memset with kzalloc

2006-12-07T16:39:41Z

Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] arch filter lists with < or > should not be accepted

2006-10-04T12:31:16Z

Currently the kernel audit system represents arch's as numbers and will gladly accept comparisons between archs using >, <, >=, <= when the only thing that makes sense is = or !=. I'm told that the next revision of auditctl will do this checking but this will provide enforcement in the kernel even for old userspace. A simple command to show the issue would be to run auditctl -d entry,always -F arch>i686 -S chmod with this patch the kernel will reject this with -EINVAL Please comment/ack/nak as soon as possible. -Eric kernel/auditfilter.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) Signed-off-by: Al Viro

[PATCH] selinux: rename selinux_ctxid_to_string

2006-09-26T15:48:52Z

Rename selinux_ctxid_to_string to selinux_sid_to_string to be consistent with other interfaces. Signed-off-by: Stephen Smalley Acked-by: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30Z

add support for AUDIT_PERM predicate Signed-off-by: Al Viro

[PATCH] update audit rule change messages

2006-09-11T17:32:17Z

Make the audit message for implicit rule removal more informative. Make the rule update message consistent with other messages. Signed-off-by: Amy Griffis Signed-off-by: Al Viro

[PATCH] fix ppid bug in 2.6.18 kernel

2006-09-11T17:32:04Z

Hello, During some troubleshooting, I found that ppid was accidentally omitted from the legacy rule section. This resulted in EINVAL for any rule with ppid sent with AUDIT_ADD. Signed-off-by: Steve Grubb Signed-off-by: Al Viro

[PATCH] introduce audit rules counter

2006-08-03T14:55:18Z

Signed-off-by: Al Viro

[PATCH] fix audit oops with invalid operator

2006-08-03T14:54:43Z

Michael C Thompson wrote: [Tue Aug 01 2006, 02:36:36PM EDT] > The trigger for this oops is: > # auditctl -a exit,always -S pread64 -F 'inode<1' Setting the err value will fix it. Signed-off-by: Amy Griffis Signed-off-by: Al Viro