History

Merge branch 'stable-4.10' of git://git.infradead.org/users/pcmoore/audit

Pull audit updates from Paul Moore: "After the small number of patches for v4.9, we've got a much bigger pile for v4.10. The bulk of these patches involve a rework of the audit backlog queue to enable us to move the netlink multicasting out of the task/thread that generates the audit record and into the kernel thread that emits the record (just like we do for the audit unicast to auditd). While we were playing with the backlog queue(s) we fixed a number of other little problems with the code, and from all the testing so far things look to be in much better shape now. Doing this also allowed us to re-enable disabling IRQs for some netns operations ("netns: avoid disabling irq for netns id"). The remaining patches fix some small problems that are well documented in the commit descriptions, as well as adding session ID filtering support" * 'stable-4.10' of git://git.infradead.org/users/pcmoore/audit: audit: use proper refcount locking on audit_sock netns: avoid disabling irq for netns id audit: don't ever sleep on a command record/message audit: handle a clean auditd shutdown with grace audit: wake up kauditd_thread after auditd registers audit: rework audit_log_start() audit: rework the audit queue handling audit: rename the queues and kauditd related functions audit: queue netlink multicast sends just like we do for unicast sends audit: fixup audit_init() audit: move kaudit thread start from auditd registration to kaudit init (#2) audit: add support for session ID user filter audit: fix formatting of AUDIT_CONFIG_CHANGE events audit: skip sessionid sentinel value when auto-incrementing audit: tame initialization warning len_abuf in audit_log_execve_info audit: less stack usage for /proc/*/loginuid

Linus Torvalds committed 9 years ago

Commit dcdaa2f2 parents 683b96f 533c7b69 files · +361 −243Browse files

Showing the changes to include/uapi/linux (1 of 9 files). Show all

Unified · Split

include/uapi/linux/audit.h+4−1
@@ -254,6 +254,7 @@ · 253 unmodified lines
254254 #define AUDIT_OBJ_LEV_LOW 22
255255 #define AUDIT_OBJ_LEV_HIGH 23
256256 #define AUDIT_LOGINUID_SET 24
257+#define AUDIT_SESSIONID 25 /* Session ID */
257258
258259 /* These are ONLY useful when checking
259260 * at syscall exit time (AUDIT_AT_EXIT). */
@@ -330,10 +331,12 @@ enum { · 70 unmodified lines
330331 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
331332 #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
332333 #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008
334+#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010
333335 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \
334336 AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \
335337 AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \
336− AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND)
338+ AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \
339+ AUDIT_FEATURE_BITMAP_SESSIONID_FILTER)
337340
338341 /* deprecated: AUDIT_VERSION_* */
339342 #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL