Pull audit updates from Paul Moore: "Audit is back for v5.5, albeit with only two patches: - Allow for the auditing of suspicious O_CREAT usage via the new AUDIT_ANOM_CREAT record. - Remove a redundant if-conditional check found during code analysis. It's a minor change, but when the pull request is only two patches long, you need filler in the pull request email" [ Heh on the pull request filler. I wish more people tried to write better pull request messages, even if maybe it's not worth it for the trivial cases ;^) - Linus ] * tag 'audit-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: remove redundant condition check in kauditd_thread() audit: Report suspicious O_CREAT usage
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -143,6 +143,7 @@ · 142 unmodified lines | ||
| 143 | 143 | #define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */ |
| 144 | 144 | #define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */ |
| 145 | 145 | #define AUDIT_ANOM_LINK 1702 /* Suspicious use of file links */ |
| 146 | +#define AUDIT_ANOM_CREAT 1703 /* Suspicious file creation */ | |
| 146 | 147 | #define AUDIT_INTEGRITY_DATA 1800 /* Data integrity verification */ |
| 147 | 148 | #define AUDIT_INTEGRITY_METADATA 1801 /* Metadata integrity verification */ |
| 148 | 149 | #define AUDIT_INTEGRITY_STATUS 1802 /* Integrity enable status */ |