diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2015-08-05 16:29:37 -0400 |
|---|---|---|
| committer | Paul Moore <pmoore@redhat.com> | 2015-08-06 16:17:25 -0400 |
| commit | 34d99af52ad40bd498ba66970579a5bc1fb1a3bc (patch) | |
| tree | fcab34928eb893eff68506685675420f0afba08e /include | |
| parent | 7f49294282c49ef426ed05eb4959728524ba140c (diff) | |
| download | op-kernel-dev-34d99af52ad40bd498ba66970579a5bc1fb1a3bc.zip op-kernel-dev-34d99af52ad40bd498ba66970579a5bc1fb1a3bc.tar.gz | |
audit: implement audit by executable
This adds the ability audit the actions of a not-yet-running process.
This patch implements the ability to filter on the executable path. Instead of
just hard coding the ino and dev of the executable we care about at the moment
the rule is inserted into the kernel, use the new audit_fsnotify
infrastructure to manage this dynamically. This means that if the filename
does not yet exist but the containing directory does, or if the inode in
question is unlinked and creat'd (aka updated) the rule will just continue to
work. If the containing directory is moved or deleted or the filesystem is
unmounted, the rule is deleted automatically. A future enhancement would be to
have the rule survive across directory disruptions.
This is a heavily modified version of a patch originally submitted by Eric
Paris with some ideas from Peter Moody.
Cc: Peter Moody <peter@hda3.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: minor whitespace clean to satisfy ./scripts/checkpatch]
Signed-off-by: Paul Moore <pmoore@redhat.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/audit.h | 1 | ||||
| -rw-r--r-- | include/uapi/linux/audit.h | 5 |
2 files changed, 5 insertions, 1 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index 759feb0..b2abc99 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -62,6 +62,7 @@ struct audit_krule { struct audit_field *inode_f; /* quick access to an inode field */ struct audit_watch *watch; /* associated watch */ struct audit_tree *tree; /* associated watched tree */ + struct audit_fsnotify_mark *exe; struct list_head rlist; /* entry in audit_{watch,tree}.rules list */ struct list_head list; /* for AUDIT_LIST* purposes only */ u64 prio; diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index d3475e1..f6ff62c 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -266,6 +266,7 @@ #define AUDIT_OBJ_UID 109 #define AUDIT_OBJ_GID 110 #define AUDIT_FIELD_COMPARE 111 +#define AUDIT_EXE 112 #define AUDIT_ARG0 200 #define AUDIT_ARG1 (AUDIT_ARG0+1) @@ -324,8 +325,10 @@ enum { #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002 +#define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ - AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME) + AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ + AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH) /* deprecated: AUDIT_VERSION_* */ #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL |
