Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. An example of the MAC_OBJ_CONTEXTS record is: type=MAC_OBJ_CONTEXTS msg=audit(1601152467.009:1050): obj_selinux=unconfined_u:object_r:user_home_t:s0 When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record the "obj=" field in other records in the event will be "obj=?". An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has multiple security modules that may make access decisions based on an object security context.
Showing the changes to include/uapi (1 of 6 files). Show all
Unified · Split
| @@ -149,6 +149,7 @@ · 148 unmodified lines | ||
| 149 | 149 | #define AUDIT_LANDLOCK_ACCESS 1423 /* Landlock denial */ |
| 150 | 150 | #define AUDIT_LANDLOCK_DOMAIN 1424 /* Landlock domain status */ |
| 151 | 151 | #define AUDIT_MAC_TASK_CONTEXTS 1425 /* Multiple LSM task contexts */ |
| 152 | +#define AUDIT_MAC_OBJ_CONTEXTS 1426 /* Multiple LSM objext contexts */ | |
| 152 | 153 | |
| 153 | 154 | #define AUDIT_FIRST_KERN_ANOM_MSG 1700 |
| 154 | 155 | #define AUDIT_LAST_KERN_ANOM_MSG 1799 |