Replace the single skb pointer in an audit_buffer with a list of skb pointers. Add the audit_stamp information to the audit_buffer as there's no guarantee that there will be an audit_context containing the stamp associated with the event. At audit_log_end() time create auxiliary records as have been added to the list. Functions are created to manage the skb list in the audit_buffer. Create a new audit record AUDIT_MAC_TASK_CONTEXTS. An example of the MAC_TASK_CONTEXTS record is: type=MAC_TASK_CONTEXTS msg=audit(1600880931.832:113) subj_apparmor=unconfined subj_smack=_ When an audit event includes a AUDIT_MAC_TASK_CONTEXTS record the "subj=" field in other records in the event will be "subj=?". An AUDIT_MAC_TASK_CONTEXTS record is supplied when the system has multiple security modules that may make access decisions based on a subject security context. Refactor audit_log_task_context(), creating a new audit_log_subj_ctx(). This is used in netlabel auditing to provide multiple subject security contexts as necessary.
Showing the changes to include/uapi (1 of 7 files). Show all
Unified · Split
| @@ -148,6 +148,7 @@ · 147 unmodified lines | |||
| 148 | #define AUDIT_IPE_POLICY_LOAD 1422 /* IPE policy load */ | 148 | #define AUDIT_IPE_POLICY_LOAD 1422 /* IPE policy load */ |
| 149 | #define AUDIT_LANDLOCK_ACCESS 1423 /* Landlock denial */ | 149 | #define AUDIT_LANDLOCK_ACCESS 1423 /* Landlock denial */ |
| 150 | #define AUDIT_LANDLOCK_DOMAIN 1424 /* Landlock domain status */ | 150 | #define AUDIT_LANDLOCK_DOMAIN 1424 /* Landlock domain status */ |
| 151 | #define AUDIT_MAC_TASK_CONTEXTS 1425 /* Multiple LSM task contexts */ | ||
| 151 | 152 | ||
| 152 | #define AUDIT_FIRST_KERN_ANOM_MSG 1700 | 153 | #define AUDIT_FIRST_KERN_ANOM_MSG 1700 |
| 153 | #define AUDIT_LAST_KERN_ANOM_MSG 1799 | 154 | #define AUDIT_LAST_KERN_ANOM_MSG 1799 |