audit: Report suspicious O_CREAT usage

This renames the very specific audit_log_link_denied() to audit_log_path_denied() and adds the AUDIT_* type as an argument. This allows for the creation of the new AUDIT_ANOM_CREAT that can be used to report the fifo/regular file creation restrictions that were introduced in commit 30aba6656f61 ("namei: allow restricted O_CREAT of FIFOs and regular files").

Kees Cook committed 7 years ago

Commit 245d7361 parent 54ecb8f4 files · +16 −9Browse files

Showing the changes to include/uapi/linux (1 of 4 files). Show all

Unified · Split

include/uapi/linux/audit.h+1−0

@@ -143,6 +143,7 @@ · 142 unmodified lines
143	143	#define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
144	144	#define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */
145	145	#define AUDIT_ANOM_LINK 1702 /* Suspicious use of file links */
	146	+#define AUDIT_ANOM_CREAT 1703 /* Suspicious file creation */
146	147	#define AUDIT_INTEGRITY_DATA 1800 /* Data integrity verification */
147	148	#define AUDIT_INTEGRITY_METADATA 1801 /* Metadata integrity verification */
148	149	#define AUDIT_INTEGRITY_STATUS 1802 /* Integrity enable status */