Emit an audit record whenever the system clock is changed (i.e. shifted by a non-zero offset) by a syscall from userspace. The syscalls than can (at the time of writing) trigger such record are: - settimeofday(2), stime(2), clock_settime(2) -- via do_settimeofday64() - adjtimex(2), clock_adjtime(2) -- via do_adjtimex() The new records have type AUDIT_TIME_INJOFFSET and contain the following fields: - sec -- the 'seconds' part of the offset - nsec -- the 'nanoseconds' part of the offset Example record (time was shifted backwards by ~15.875 seconds): type=TIME_INJOFFSET msg=audit(1530616049.652:13): sec=-16 nsec=124887145 The records of this type will be associated with the corresponding syscall records.
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -114,6 +114,7 @@ · 113 unmodified lines | ||
| 114 | 114 | #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ |
| 115 | 115 | #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ |
| 116 | 116 | #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ |
| 117 | +#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */ | |
| 117 | 118 | |
| 118 | 119 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ |
| 119 | 120 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |