Commit d2fac0af authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20211101' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "Add some additional audit logging to capture the openat2() syscall
  open_how struct info.

  Previous variations of the open()/openat() syscalls allowed audit
  admins to inspect the syscall args to get the information contained in
  the new open_how struct used in openat2()"

* tag 'audit-pr-20211101' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: return early if the filter rule has a lower priority
  audit: add OPENAT2 record to list "how" info
  audit: add support for the openat2 syscall
  audit: replace magic audit syscall class numbers with macros
  lsm_audit: avoid overloading the "key" audit field
  audit: Convert to SPDX identifier
  audit: rename struct node to struct audit_node to prevent future name collisions
parents cdab10bf d9516f34

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -3127,6 +3127,7 @@ W: https://github.com/linux-audit 
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git

F:	include/asm-generic/audit_*.h

F:	include/linux/audit.h

F:	include/linux/audit_arch.h

F:	include/uapi/linux/audit.h

F:	kernel/audit*

F:	lib/*audit.c

arch/alpha/kernel/audit.c

+6 −4
Original line number Diff line number Diff line
@@ -37,13 +37,15 @@ int audit_classify_syscall(int abi, unsigned syscall) 
{

	switch(syscall) {

	case __NR_open:

		return 2;

		return AUDITSC_OPEN;

	case __NR_openat:

		return 3;

		return AUDITSC_OPENAT;

	case __NR_execve:

		return 5;

		return AUDITSC_EXECVE;

	case __NR_openat2:

		return AUDITSC_OPENAT2;

	default:

		return 0;

		return AUDITSC_NATIVE;

	}

}

arch/ia64/kernel/audit.c

+6 −4
Original line number Diff line number Diff line
@@ -38,13 +38,15 @@ int audit_classify_syscall(int abi, unsigned syscall) 
{

	switch(syscall) {

	case __NR_open:

		return 2;

		return AUDITSC_OPEN;

	case __NR_openat:

		return 3;

		return AUDITSC_OPENAT;

	case __NR_execve:

		return 5;

		return AUDITSC_EXECVE;

	case __NR_openat2:

		return AUDITSC_OPENAT2;

	default:

		return 0;

		return AUDITSC_NATIVE;

	}

}

arch/parisc/kernel/audit.c

+6 −4
Original line number Diff line number Diff line
@@ -47,13 +47,15 @@ int audit_classify_syscall(int abi, unsigned syscall) 
#endif

	switch (syscall) {

	case __NR_open:

		return 2;

		return AUDITSC_OPEN;

	case __NR_openat:

		return 3;

		return AUDITSC_OPENAT;

	case __NR_execve:

		return 5;

		return AUDITSC_EXECVE;

	case __NR_openat2:

		return AUDITSC_OPENAT2;

	default:

		return 0;

		return AUDITSC_NATIVE;

	}

}

arch/parisc/kernel/compat_audit.c

+7 −4
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include <linux/audit_arch.h>

#include <asm/unistd.h>



unsigned int parisc32_dir_class[] = {
@@ -30,12 +31,14 @@ int parisc32_classify_syscall(unsigned syscall) 
{

	switch (syscall) {

	case __NR_open:

		return 2;

		return AUDITSC_OPEN;

	case __NR_openat:

		return 3;

		return AUDITSC_OPENAT;

	case __NR_execve:

		return 5;

		return AUDITSC_EXECVE;

	case __NR_openat2:

		return AUDITSC_OPENAT2;

	default:

		return 1;

		return AUDITSC_COMPAT;

	}

}