audit: add feature audit_lost reset

Add a method to reset the audit_lost value. An AUDIT_SET message with the AUDIT_STATUS_LOST flag set by itself will return a positive value repesenting the current audit_lost value and reset the counter to zero. If AUDIT_STATUS_LOST is not the only flag set, the reset command will be ignored. The value sent with the command is ignored. The return value will be the +ve lost value at reset time. An AUDIT_CONFIG_CHANGE message will be queued to the listening audit daemon. The message will be a standard CONFIG_CHANGE message with the fields "lost=0" and "old=" with the latter containing the value of audit_lost at reset time. See: https://github.com/linux-audit/audit-kernel/issues/3

Richard Guy Briggs committed 9 years ago

Commit 92c82e81 parent 89670af2 files · +12 −2Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/audit.h+5−1

@@ -326,15 +326,19 @@ enum { · 325 unmodified lines
326	326	#define AUDIT_STATUS_RATE_LIMIT 0x0008
327	327	#define AUDIT_STATUS_BACKLOG_LIMIT 0x0010
328	328	#define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020
	329	+#define AUDIT_STATUS_LOST 0x0040
329	330
330	331	#define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
331	332	#define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
332	333	#define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
333	334	#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010
	335	+#define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020
	336	+
334	337	#define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT \| \
335	338	AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME \| \
336	339	AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH \| \
337		− AUDIT_FEATURE_BITMAP_SESSIONID_FILTER)
	340	+ AUDIT_FEATURE_BITMAP_SESSIONID_FILTER \| \
	341	+ AUDIT_FEATURE_BITMAP_LOST_RESET)
338	342
339	343	/* deprecated: AUDIT_VERSION_* */
340	344	#define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL