Re: [PATCH] audit: log the audit_names record type
On Wednesday, May 08, 2013 10:32:23 AM Jeff Layton wrote:
...to make it clear what the intent behind each record's
operation was.
In many cases you can infer this, based on the context of the syscall
and the result. In other cases it's not so obvious. For instance, in
the case where you have a file being renamed over another, you'll have
two different records with the same filename but different inode info.
By logging this information we can clearly tell which one was created
and which was deleted.
Space is generally at a premium. Every byte counts. Rather than print strings,
which we usually avoid, it might be better to just print the number and let
user space convert that to something readable.
All of these records are to point out what the object of the syscall is. And
my understanding is that these labels are to describe the action or operation
being performed. So, maybe naming the field "objact=" or "objop="
would save
a couple bytes?
-Steve
Signed-off-by: Jeff Layton <jlayton(a)redhat.com>
---
kernel/auditsc.c | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 8d87439..4f90536 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1575,6 +1575,26 @@ static void audit_log_name(struct audit_context
*context, struct audit_names *n, }
}
+ /* log the audit_names record type */
+ audit_log_format(ab, " nametype=");
+ switch(n->type) {
+ case AUDIT_TYPE_NORMAL:
+ audit_log_format(ab, "NORMAL");
+ break;
+ case AUDIT_TYPE_PARENT:
+ audit_log_format(ab, "PARENT");
+ break;
+ case AUDIT_TYPE_CHILD_DELETE:
+ audit_log_format(ab, "DELETE");
+ break;
+ case AUDIT_TYPE_CHILD_CREATE:
+ audit_log_format(ab, "CREATE");
+ break;
+ default:
+ audit_log_format(ab, "UNKNOWN");
+ break;
+ }
+
audit_log_fcaps(ab, n);
audit_log_end(ab);