Add a method to reset the audit_lost value. An AUDIT_SET message with the AUDIT_STATUS_LOST flag set by itself will return a positive value repesenting the current audit_lost value and reset the counter to zero. If AUDIT_STATUS_LOST is not the only flag set, the reset command will be ignored. The value sent with the command is ignored. The return value will be the +ve lost value at reset time. An AUDIT_CONFIG_CHANGE message will be queued to the listening audit daemon. The message will be a standard CONFIG_CHANGE message with the fields "lost=0" and "old=" with the latter containing the value of audit_lost at reset time. See: https://github.com/linux-audit/audit-kernel/issues/3
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -326,15 +326,19 @@ enum { · 325 unmodified lines | |||
| 326 | #define AUDIT_STATUS_RATE_LIMIT 0x0008 | 326 | #define AUDIT_STATUS_RATE_LIMIT 0x0008 |
| 327 | #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 | 327 | #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 |
| 328 | #define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020 | 328 | #define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020 |
| 329 | #define AUDIT_STATUS_LOST 0x0040 | ||
| 329 | 330 | ||
| 330 | #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001 | 331 | #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001 |
| 331 | #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002 | 332 | #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002 |
| 332 | #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004 | 333 | #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004 |
| 333 | #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 | 334 | #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 |
| 335 | #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 | ||
| 336 | |||
| 334 | #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ | 337 | #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ |
| 335 | AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ | 338 | AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ |
| 336 | AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ | 339 | AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ |
| 337 | AUDIT_FEATURE_BITMAP_SESSIONID_FILTER) | 340 | AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ |
| 341 | AUDIT_FEATURE_BITMAP_LOST_RESET) | ||
| 338 | 342 | ||
| 339 | /* deprecated: AUDIT_VERSION_* */ | 343 | /* deprecated: AUDIT_VERSION_* */ |
| 340 | #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL | 344 | #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL |