Re: [PATCH v26 21/25] audit: add support for non-syscall auxiliary records
On Thu, May 13, 2021 at 4:31 PM Casey Schaufler <casey(a)schaufler-ca.com> wrote:
Standalone audit records have the timestamp and serial number generated
on the fly and as such are unique, making them standalone. This new
function audit_alloc_local() generates a local audit context that will
be used only for a standalone record and its auxiliary record(s). The
context is discarded immediately after the local associated records are
produced.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com>
Cc: linux-audit(a)redhat.com
To: Richard Guy Briggs <rgb(a)redhat.com>
---
include/linux/audit.h | 8 ++++++++
kernel/audit.h | 1 +
kernel/auditsc.c | 33 ++++++++++++++++++++++++++++-----
3 files changed, 37 insertions(+), 5 deletions(-)
At some point I suspect we will need to add filtering for these
"local" records, but that is a problem for another day.
Acked-by: Paul Moore <paul(a)paul-moore.com>
--
paul moore
www.paul-moore.com