Re: [PATCH v3 3/3] fanotify: Allow audit to use the full permission event response

This patch passes the full value so that the audit function can use all of it. The audit function was updated to log the additional information in the AUDIT_FANOTIFY record. The following is an example of the new record format: type=FANOTIFY msg=audit(1600385147.372:590): resp=2 fan_type=1 fan_ctx=17 Suggested-by: Steve Grubb <sgrubb(a)redhat.com&gt; Link: https://lore.kernel.org/r/3075502.aeNJFYEL58@x2 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- fs/notify/fanotify/fanotify.c | 4 +++- include/linux/audit.h | 9 +++++---- kernel/auditsc.c | 18 +++++++++++++++--- 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6973be0bf6c9..cb93c6ed07cd 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2893,10 +2894,21 @@ void __audit_log_kern_module(char *name) context->type = AUDIT_KERN_MODULE; } -void __audit_fanotify(u32 response) +void __audit_fanotify(u32 response, u32 type, union fanotify_response_extra *info) { - audit_log(audit_context(), GFP_KERNEL, - AUDIT_FANOTIFY, "resp=%u", response); + switch (type) { + case FAN_RESPONSE_INFO_AUDIT_RULE: + audit_log(audit_context(), GFP_KERNEL, AUDIT_FANOTIFY, + "resp=%u fan_type=%u fan_ctx=%u", + response, type, info->audit_rule); + break; + case FAN_RESPONSE_INFO_NONE: + default: + audit_log(audit_context(), GFP_KERNEL, AUDIT_FANOTIFY, + "resp=%u fan_type=%u fan_ctx=?", + response, type); + break; + } }