Commit 54d3218b authored by Eric Paris's avatar Eric Paris Committed by Al Viro
Browse files

audit: allow audit matching on inode gid 



Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent efaffd6e

include/linux/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -224,6 +224,7 @@ 
#define AUDIT_DIR	107

#define AUDIT_FILETYPE	108

#define AUDIT_OBJ_UID	109

#define AUDIT_OBJ_GID	110



#define AUDIT_ARG0      200

#define AUDIT_ARG1      (AUDIT_ARG0+1)

kernel/auditfilter.c

+1 −0
Original line number Diff line number Diff line
@@ -462,6 +462,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 
		case AUDIT_ARG2:

		case AUDIT_ARG3:

		case AUDIT_OBJ_UID:

		case AUDIT_OBJ_GID:

			break;

		case AUDIT_ARCH:

			entry->rule.arch_f = f;

kernel/auditsc.c

+12 −0
Original line number Diff line number Diff line
@@ -598,6 +598,18 @@ static int audit_filter_rules(struct task_struct *tsk, 
				}

			}

			break;

		case AUDIT_OBJ_GID:

			if (name) {

				result = audit_comparator(name->gid, f->op, f->val);

			} else if (ctx) {

				list_for_each_entry(n, &ctx->names_list, list) {

					if (audit_comparator(n->gid, f->op, f->val)) {

						++result;

						break;

					}

				}

			}

			break;

		case AUDIT_WATCH:

			if (name)

				result = audit_watch_compare(rule->watch, name->ino, name->dev);