[PATCH ghau93 v1] add support to filter on sockaddr family
Provide a method to filter on network address family.
This adds support for the kernel filter for sockaddr family,
AUDIT_SADDR_FAM, adding the command line option "saddr_fam" to auditctl.
See: https://github.com/linux-audit/audit-kernel/issues/64
See: https://github.com/linux-audit/audit-userspace/issues/93
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
lib/errormsg.h | 2 ++
lib/fieldtab.h | 1 +
lib/libaudit.c | 6 ++++++
lib/libaudit.h | 3 +++
4 files changed, 12 insertions(+)
diff --git a/lib/errormsg.h b/lib/errormsg.h
index fd8c4a4b1311..fc03b2475034 100644
--- a/lib/errormsg.h
+++ b/lib/errormsg.h
@@ -70,6 +70,7 @@ struct msg_tab {
#define EAU_FIELDUNAVAIL 34
#define EAU_FILTERNOSUPPORT 35
#define EAU_FSTYPEUNKNOWN 36
+#define EAU_FIELDVALTOOBIG 37
static const struct msg_tab err_msgtab[] = {
{ -EAU_OPMISSING, 2, "-F missing operation for" },
{ -EAU_FIELDUNKNOWN, 2, "-F unknown field:" },
@@ -107,5 +108,6 @@ static const struct msg_tab err_msgtab[] = {
{ -EAU_FIELDUNAVAIL, 1, "field is not valid for the filter" },
{ -EAU_FILTERNOSUPPORT, 1, "filter is not supported by the kernel" },
{ -EAU_FSTYPEUNKNOWN, 2, "file system type is unknown for field:" },
+ { -EAU_FIELDVALTOOBIG, 2, "value is too large for field:" },
};
#endif
diff --git a/lib/fieldtab.h b/lib/fieldtab.h
index c425d5b86049..b597cafb2df8 100644
--- a/lib/fieldtab.h
+++ b/lib/fieldtab.h
@@ -69,3 +69,4 @@ _S(AUDIT_ARG3, "a3" )
_S(AUDIT_FILTERKEY, "key" )
_S(AUDIT_EXE, "exe" )
+_S(AUDIT_SADDR_FAM, "saddr_fam" )
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 2af017a0e520..2e4b148edde9 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -40,6 +40,7 @@
#include <limits.h> /* for PATH_MAX */
#include <sys/stat.h>
#include <sys/types.h>
+#include <sys/socket.h> /* AF_MAX */
#ifdef HAVE_LIBCAP_NG
#include <cap-ng.h>
#endif
@@ -1742,6 +1743,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const
char *pair,
else if (strcmp(v, "unset") == 0)
rule->values[rule->field_count] = 4294967295;
break;
+ case AUDIT_SADDR_FAM:
+ rule->values[rule->field_count] = strtoul(v, NULL, 0);
+ if (rule->values[rule->field_count] >= AF_MAX)
+ return -EAU_FIELDVALTOOBIG;
+ break;
case AUDIT_DEVMAJOR...AUDIT_INODE:
case AUDIT_SUCCESS:
if (flags != AUDIT_FILTER_EXIT)
diff --git a/lib/libaudit.h b/lib/libaudit.h
index 77e4142beea2..89fe4839a69b 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -356,6 +356,9 @@ extern "C" {
#ifndef AUDIT_EXE
#define AUDIT_EXE 112
#endif
+#ifndef AUDIT_SADDR_FAM
+#define AUDIT_SADDR_FAM 113
+#endif
#ifndef AUDIT_SESSIONID
#define AUDIT_SESSIONID 25
--
1.8.3.1