summaryrefslogtreecommitdiffstats
path: root/include/linux/audit.h
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2012-01-03 14:23:07 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2012-01-17 16:16:59 -0500
commitefaffd6e4417860c67576ac760dd6e8bbd15f006 (patch)
treea59ee886b609bbf761fb75744e5e468264c67ab5 /include/linux/audit.h
parent6422e78de6880c66a82af512d9bd0c85eb62e661 (diff)
downloadop-kernel-dev-efaffd6e4417860c67576ac760dd6e8bbd15f006.zip
op-kernel-dev-efaffd6e4417860c67576ac760dd6e8bbd15f006.tar.gz
audit: allow matching on obj_uid
Allow syscall exit filter matching based on the uid of the owner of an inode used in a syscall. aka: auditctl -a always,exit -S open -F obj_uid=0 -F perm=wa Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'include/linux/audit.h')
-rw-r--r--include/linux/audit.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 67b66c3..55cb3da 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -223,6 +223,7 @@
#define AUDIT_PERM 106
#define AUDIT_DIR 107
#define AUDIT_FILETYPE 108
+#define AUDIT_OBJ_UID 109
#define AUDIT_ARG0 200
#define AUDIT_ARG1 (AUDIT_ARG0+1)
OpenPOWER on IntegriCloud