Pull audit updates from Eric Paris: "Nothing amazing. Formatting, small bug fixes, couple of fixes where we didn't get records due to some old VFS changes, and a change to how we collect execve info..." Fixed conflict in fs/exec.c as per Eric and linux-next. * git://git.infradead.org/users/eparis/audit: (28 commits) audit: fix type of sessionid in audit_set_loginuid() audit: call audit_bprm() only once to add AUDIT_EXECVE information audit: move audit_aux_data_execve contents into audit_context union audit: remove unused envc member of audit_aux_data_execve audit: Kill the unused struct audit_aux_data_capset audit: do not reject all AUDIT_INODE filter types audit: suppress stock memalloc failure warnings since already managed audit: log the audit_names record type audit: add child record before the create to handle case where create fails audit: use given values in tty_audit enable api audit: use nlmsg_len() to get message payload length audit: use memset instead of trying to initialize field by field audit: fix info leak in AUDIT_GET requests audit: update AUDIT_INODE filter rule to comparator function audit: audit feature to set loginuid immutable audit: audit feature to only allow unsetting the loginuid audit: allow unsetting the loginuid (with priv) audit: remove CONFIG_AUDIT_LOGINUID_IMMUTABLE audit: loginuid functions coding style selinux: apply selinux checks on new audit message types ...
Showing the changes to include/uapi/linux (1 of 12 files). Show all
Unified · Split
| @@ -68,6 +68,9 @@ · 67 unmodified lines | ||
| 68 | 68 | #define AUDIT_MAKE_EQUIV 1015 /* Append to watched tree */ |
| 69 | 69 | #define AUDIT_TTY_GET 1016 /* Get TTY auditing status */ |
| 70 | 70 | #define AUDIT_TTY_SET 1017 /* Set TTY auditing status */ |
| 71 | +#define AUDIT_SET_FEATURE 1018 /* Turn an audit feature on or off */ | |
| 72 | +#define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */ | |
| 73 | +#define AUDIT_FEATURE_CHANGE 1020 /* audit log listing feature changes */ | |
| 71 | 74 | |
| 72 | 75 | #define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */ |
| 73 | 76 | #define AUDIT_USER_AVC 1107 /* We filter this differently */ |
| @@ -357,6 +360,12 @@ enum { · 283 unmodified lines | ||
| 357 | 360 | #define AUDIT_PERM_READ 4 |
| 358 | 361 | #define AUDIT_PERM_ATTR 8 |
| 359 | 362 | |
| 363 | +/* MAX_AUDIT_MESSAGE_LENGTH is set in audit:lib/libaudit.h as: | |
| 364 | + * 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1 | |
| 365 | + * max header+body+tailer: 44 + 29 + 32 + 262 + 7 + pad | |
| 366 | + */ | |
| 367 | +#define AUDIT_MESSAGE_TEXT_MAX 8560 | |
| 368 | + | |
| 360 | 369 | struct audit_status { |
| 361 | 370 | __u32 mask; /* Bit mask for valid entries */ |
| 362 | 371 | __u32 enabled; /* 1 = enabled, 0 = disabled */ |
| @@ -368,11 +377,28 @@ struct audit_status { · 5 unmodified lines | ||
| 368 | 377 | __u32 backlog; /* messages waiting in queue */ |
| 369 | 378 | }; |
| 370 | 379 | |
| 380 | +struct audit_features { | |
| 381 | +#define AUDIT_FEATURE_VERSION 1 | |
| 382 | + __u32 vers; | |
| 383 | + __u32 mask; /* which bits we are dealing with */ | |
| 384 | + __u32 features; /* which feature to enable/disable */ | |
| 385 | + __u32 lock; /* which features to lock */ | |
| 386 | +}; | |
| 387 | + | |
| 388 | +#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0 | |
| 389 | +#define AUDIT_FEATURE_LOGINUID_IMMUTABLE 1 | |
| 390 | +#define AUDIT_LAST_FEATURE AUDIT_FEATURE_LOGINUID_IMMUTABLE | |
| 391 | + | |
| 392 | +#define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) | |
| 393 | +#define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ | |
| 394 | + | |
| 371 | 395 | struct audit_tty_status { |
| 372 | 396 | __u32 enabled; /* 1 = enabled, 0 = disabled */ |
| 373 | 397 | __u32 log_passwd; /* 1 = enabled, 0 = disabled */ |
| 374 | 398 | }; |
| 375 | 399 | |
| 400 | +#define AUDIT_UID_UNSET (unsigned int)-1 | |
| 401 | + | |
| 376 | 402 | /* audit_rule_data supports filter rules with both integer and string |
| 377 | 403 | * fields. It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and |
| 378 | 404 | * AUDIT_LIST_RULES requests. |