Re: [PATCH 2/2] audit: log binding and unbinding to netlink multicast socket

Log information about programs connecting and disconnecting to the audit netlink multicast socket. This is needed so that during investigations a security officer can tell who or what had access to the audit trail. This helps to meet the FAU_SAR.2 requirement for Common Criteria. Signed-off-by: Steve Grubb <sgrubb(a)redhat.com&gt; --- include/uapi/linux/audit.h | 1 + kernel/audit.c | 30 ++++++++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c index 29fb38b..3253f1b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1135,13 +1135,36 @@ void audit_log_task_simple(struct audit_buffer *ab, struct task_struct *tsk) } EXPORT_SYMBOL(audit_log_task_simple); +static void audit_log_bind(int group, const char *op, int err) +{

+ struct audit_buffer *ab; + + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_EVENT_LISTENER); + if (!ab) + return; + + audit_log_task_simple(ab, current); + audit_log_format(ab, " nlnk-grp=%d", group); + audit_log_format(ab, " op=%s", op); + audit_log_format(ab, " res=%d", !err); + audit_log_end(ab);