Add a netlink multicast socket with one group to kaudit for "best-effort" delivery to read-only userspace clients such as systemd, in addition to the existing bidirectional unicast auditd userspace client. Currently, auditd is intended to use the CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE capabilities, but actually uses CAP_NET_ADMIN. The CAP_AUDIT_READ capability is added for use by read-only AUDIT_NLGRP_READLOG netlink multicast group clients to the kaudit subsystem. This will safely give access to services such as systemd to consume audit logs while ensuring write access remains restricted for integrity.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -373,6 +373,14 @@ enum { · 372 unmodified lines | |||
| 373 | */ | 373 | */ |
| 374 | #define AUDIT_MESSAGE_TEXT_MAX 8560 | 374 | #define AUDIT_MESSAGE_TEXT_MAX 8560 |
| 375 | 375 | ||
| 376 | /* Multicast Netlink socket groups (default up to 32) */ | ||
| 377 | enum audit_nlgrps { | ||
| 378 | AUDIT_NLGRP_NONE, /* Group 0 not used */ | ||
| 379 | AUDIT_NLGRP_READLOG, /* "best effort" read only socket */ | ||
| 380 | __AUDIT_NLGRP_MAX | ||
| 381 | }; | ||
| 382 | #define AUDIT_NLGRP_MAX (__AUDIT_NLGRP_MAX - 1) | ||
| 383 | |||
| 376 | struct audit_status { | 384 | struct audit_status { |
| 377 | __u32 mask; /* Bit mask for valid entries */ | 385 | __u32 mask; /* Bit mask for valid entries */ |
| 378 | __u32 enabled; /* 1 = enabled, 0 = disabled */ | 386 | __u32 enabled; /* 1 = enabled, 0 = disabled */ |