diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2020-07-03 12:56:19 -0400 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2020-07-08 19:02:11 -0400 |
| commit | d7481b24b816b8c3955a9eaf01b97e2bd7f61a37 (patch) | |
| tree | 0809d95b1ab314464940e38ffaa640eb9670fe65 /include/linux/audit.h | |
| parent | 68df2ed54487679f815d61b750d3bcf733ffd79e (diff) | |
| download | linux-d7481b24b816b8c3955a9eaf01b97e2bd7f61a37.tar.gz linux-d7481b24b816b8c3955a9eaf01b97e2bd7f61a37.tar.bz2 linux-d7481b24b816b8c3955a9eaf01b97e2bd7f61a37.zip | |
audit: issue CWD record to accompany LSM_AUDIT_DATA_* records
The LSM_AUDIT_DATA_* records for PATH, FILE, IOCTL_OP, DENTRY and INODE
are incomplete without the task context of the AUDIT Current Working
Directory record. Add it.
This record addition can't use audit_dummy_context to determine whether
or not to store the record information since the LSM_AUDIT_DATA_*
records are initiated by various LSMs independent of any audit rules.
context->in_syscall is used to determine if it was called in user
context like audit_getname.
Please see the upstream issue
https://github.com/linux-audit/audit-kernel/issues/96
Adapted from Vladis Dronov's v2 patch.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/linux/audit.h')
| -rw-r--r-- | include/linux/audit.h | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index b5478c64bc69..523f77494847 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -292,7 +292,7 @@ extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, extern void __audit_syscall_exit(int ret_success, long ret_value); extern struct filename *__audit_reusename(const __user char *uptr); extern void __audit_getname(struct filename *name); - +extern void __audit_getcwd(void); extern void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags); extern void __audit_file(const struct file *); @@ -351,6 +351,11 @@ static inline void audit_getname(struct filename *name) if (unlikely(!audit_dummy_context())) __audit_getname(name); } +static inline void audit_getcwd(void) +{ + if (unlikely(audit_context())) + __audit_getcwd(); +} static inline void audit_inode(struct filename *name, const struct dentry *dentry, unsigned int aflags) { @@ -579,6 +584,8 @@ static inline struct filename *audit_reusename(const __user char *name) } static inline void audit_getname(struct filename *name) { } +static inline void audit_getcwd(void) +{ } static inline void audit_inode(struct filename *name, const struct dentry *dentry, unsigned int aflags) |