[GIT PULL] Audit patches for v4.12

Hi Linus, Fourteen audit patches for v4.12 that span the full range of fixes, new features, and internal cleanups. We have a patches to move to 64-bit timestamps, convert refcounts from atomic_t to refcount_t, track PIDs using the pid struct instead of pid_t, convert our own private audit buffer cache to a standard kmem_cache, log kernel module names when they are unloaded, and normalize the NETFILTER_PKT to make the userspace folks happier. From a fixes perspective, the most important is likely the auditd connection tracking RCU fix; it was a rather brain dead bug that I'll take the blame for, but thankfully it didn't seem to affect many people (only one report). I think the patch subject lines and commit descriptions do a pretty good job of explaining the details and why the changes are important so I'll point you there instead of duplicating it here; as usual, if you have any questions you know where to find us. We also manage to take out more code than we put in this time, that always makes me happy :) Please merge for v4.12. -Paul --- The following changes since commit a351e9b9fc24e982ec2f0e76379a49826036da12: Linux 4.11 (2017-04-30 19:47:48 -0700) are available in the git repository at: git://git.infradead.org/users/pcmoore/audit stable-4.12 for you to fetch changes up to 48d0e023af9799cd7220335baf8e3ba61eeafbeb: audit: fix the RCU locking for the auditd_connection structure (2017-05-02 10:16:05 -0400) ---------------------------------------------------------------- Deepa Dinamani (1): audit: Use timespec64 to represent audit timestamps Elena Reshetova (2): audit: convert audit_tree.count from atomic_t to refcount_t audit: convert audit_watch.count from atomic_t to refcount_t Nicholas Mc Guire (3): audit: remove unnecessary semicolon in audit_field_valid() audit: remove unnecessary semicolon in audit_mark_handle_event() audit: remove unnecessary semicolon in audit_watch_handle_event() Paul Moore (5): audit: combine audit_receive() and audit_receive_skb() audit: kernel generated netlink traffic should have a portid of 0 audit: store the auditd PID as a pid struct instead of pid_t audit: use kmem_cache to manage the audit_buffer cache audit: fix the RCU locking for the auditd_connection structure Richard Guy Briggs (3): audit: log module name on delete_module netfilter: use consistent ipv4 network offset in xt_AUDIT audit: normalize NETFILTER_PKT include/linux/audit.h | 7 +- kernel/audit.c | 319 +++++++++++++++++++++++-------------------- kernel/audit.h | 7 +- kernel/audit_fsnotify.c | 2 +- kernel/audit_tree.c | 9 +- kernel/audit_watch.c | 11 +- kernel/auditfilter.c | 18 ++- kernel/auditsc.c | 6 +- kernel/module.c | 2 + net/netfilter/xt_AUDIT.c | 126 +++++-------------- 10 files changed, 232 insertions(+), 275 deletions(-) -- paul moore www.paul-moore.com