| commit | 02d86a568c6d2d335256864451ac8ce781bc5652 | |
| author | Eric Paris <eparis@redhat.com> | |
| Tue, 3 Jan 2012 19:23:08 +0000 (3 14:23 -0500) | ||
| committer | Al Viro <viro@zeniv.linux.org.uk> | |
| Tue, 17 Jan 2012 21:17:01 +0000 (17 16:17 -0500) | ||
| tree | 3ef085bd96cc79733cff28993379dbbd4b855813 | treesnapshot (tar.gz zip) |
| parent | 29ef73b7a823b77a7cd0bdd7d7cded3fb6c2587b | commitdiff |
audit: allow interfield comparison in audit rules
We wish to be able to audit when a uid=500 task accesses a file which is
uid=0. Or vice versa. This patch introduces a new audit filter type
AUDIT_FIELD_COMPARE which takes as an 'enum' which indicates which fields
should be compared. At this point we only define the task->uid vs
inode->uid, but other comparisons can be added.
Signed-off-by: Eric Paris <eparis@redhat.com>
We wish to be able to audit when a uid=500 task accesses a file which is
uid=0. Or vice versa. This patch introduces a new audit filter type
AUDIT_FIELD_COMPARE which takes as an 'enum' which indicates which fields
should be compared. At this point we only define the task->uid vs
inode->uid, but other comparisons can be added.
Signed-off-by: Eric Paris <eparis@redhat.com>
| include/linux/audit.h | diffblobblamehistory | |
| kernel/auditfilter.c | diffblobblamehistory | |
| kernel/auditsc.c | diffblobblamehistory |