This patch adds AppArmor support to the audit subsystem. It creates id 1500 (already included in the the upstream auditd package) for AppArmor messages. It also exports the audit_log_vformat function (analagous to having both printk and vprintk exported).

Signed-off-by: Tony Jones <tonyj(a)suse.de&gt; --- include/linux/audit.h | 5 +++++ kernel/audit.c | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) --- linux-2.6.17-rc1.orig/include/linux/audit.h +++ linux-2.6.17-rc1/include/linux/audit.h @@ -95,6 +95,8 @@ #define AUDIT_LAST_KERN_ANOM_MSG 1799 #define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */ +#define AUDIT_AA 1500 /* AppArmor audit */ + #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ /* Rule flags */ @@ -349,6 +351,9 @@ __attribute__((format(printf,4,5))); extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type); +extern void audit_log_vformat(struct audit_buffer *ab, + const char *fmt, va_list args) + __attribute__((format(printf,2,0))); extern void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) __attribute__((format(printf,2,3))); --- linux-2.6.17-rc1.orig/kernel/audit.c +++ linux-2.6.17-rc1/kernel/audit.c @@ -797,7 +797,7 @@ * will be called a second time. Currently, we assume that a printk * can't format message larger than 1024 bytes, so we don't either. */ -static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, +void audit_log_vformat(struct audit_buffer *ab, const char *fmt, va_list args) { int len, avail; @@ -999,4 +999,5 @@ EXPORT_SYMBOL(audit_log_start); EXPORT_SYMBOL(audit_log_end); EXPORT_SYMBOL(audit_log_format); +EXPORT_SYMBOL(audit_log_vformat); EXPORT_SYMBOL(audit_log); - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/