Pull audit updates from Paul Moore: "Add some additional audit logging to capture the openat2() syscall open_how struct info. Previous variations of the open()/openat() syscalls allowed audit admins to inspect the syscall args to get the information contained in the new open_how struct used in openat2()" * tag 'audit-pr-20211101' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: return early if the filter rule has a lower priority audit: add OPENAT2 record to list "how" info audit: add support for the openat2 syscall audit: replace magic audit syscall class numbers with macros lsm_audit: avoid overloading the "key" audit field audit: Convert to SPDX identifier audit: rename struct node to struct audit_node to prevent future name collisions
Showing the changes to include/uapi/linux (1 of 23 files). Show all
Unified · Split
| @@ -119,6 +119,7 @@ · 118 unmodified lines | ||
| 119 | 119 | #define AUDIT_BPF 1334 /* BPF subsystem */ |
| 120 | 120 | #define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */ |
| 121 | 121 | #define AUDIT_URINGOP 1336 /* io_uring operation */ |
| 122 | +#define AUDIT_OPENAT2 1337 /* Record showing openat2 how args */ | |
| 122 | 123 | |
| 123 | 124 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ |
| 124 | 125 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |