Re: [PATCH ghak10 v8 1/2] timekeeping: Audit clock adjustments

Emit an audit record whenever the system clock is changed (i.e. shifted by a non-zero offset) by a syscall from userspace. The syscalls than can (at the time of writing) trigger such record are: - settimeofday(2), stime(2), clock_settime(2) -- via do_settimeofday64() - adjtimex(2), clock_adjtime(2) -- via do_adjtimex() The new records have type AUDIT_TIME_INJOFFSET and contain the following fields: - sec -- the 'seconds' part of the offset - nsec -- the 'nanoseconds' part of the offset Example record (time was shifted backwards by ~15.875 seconds): type=TIME_INJOFFSET msg=audit(1530616049.652:13): sec=-16 nsec=124887145 The records of this type will be associated with the corresponding syscall records. Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com&gt; Reviewed-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de&gt; --- include/linux/audit.h | 14 ++++++++++++++ include/uapi/linux/audit.h | 1 + kernel/auditsc.c | 6 ++++++ kernel/time/timekeeping.c | 6 ++++++ 4 files changed, 27 insertions(+)