summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2013-05-08 10:32:23 -0400
committerEric Paris <eparis@redhat.com>2013-11-05 11:09:04 -0500
commitd3aea84a4ace5ff9ce7fb7714cee07bebef681c2 (patch)
tree59db7631075067f16c8d5f19286b7e075180b4be /kernel
parent14e972b4517128ac8e30e3de2ee4fbd995084223 (diff)
downloadlinux-stable-d3aea84a4ace5ff9ce7fb7714cee07bebef681c2.tar.gz
linux-stable-d3aea84a4ace5ff9ce7fb7714cee07bebef681c2.tar.bz2
linux-stable-d3aea84a4ace5ff9ce7fb7714cee07bebef681c2.zip
audit: log the audit_names record type
...to make it clear what the intent behind each record's operation was. In many cases you can infer this, based on the context of the syscall and the result. In other cases it's not so obvious. For instance, in the case where you have a file being renamed over another, you'll have two different records with the same filename but different inode info. By logging this information we can clearly tell which one was created and which was deleted. This fixes what was broken in commit bfcec708. Commit 79f6530c should also be backported to stable v3.7+. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/audit.c20
1 files changed, 20 insertions, 0 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 616164038ad4..b8831ac25b70 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1640,6 +1640,26 @@ void audit_log_name(struct audit_context *context, struct audit_names *n,
}
}
+ /* log the audit_names record type */
+ audit_log_format(ab, " nametype=");
+ switch(n->type) {
+ case AUDIT_TYPE_NORMAL:
+ audit_log_format(ab, "NORMAL");
+ break;
+ case AUDIT_TYPE_PARENT:
+ audit_log_format(ab, "PARENT");
+ break;
+ case AUDIT_TYPE_CHILD_DELETE:
+ audit_log_format(ab, "DELETE");
+ break;
+ case AUDIT_TYPE_CHILD_CREATE:
+ audit_log_format(ab, "CREATE");
+ break;
+ default:
+ audit_log_format(ab, "UNKNOWN");
+ break;
+ }
+
audit_log_fcaps(ab, n);
audit_log_end(ab);
}