[RFC PATCH ghak10 v3 1/3] audit: Add AUDIT_TIME_* record types

This patch adds two auxiliary record types that will be used to annotate the adjtimex SYSCALL records with the NTP/timekeeping values that have been changed (if any). Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com&gt; --- include/uapi/linux/audit.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 4e3eaba84175..242ce562b41a 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -114,6 +114,8 @@ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ +#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */ +#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ -- 2.17.1