Provide a method to filter on network address family. This adds support for the kernel filter for sockaddr family, AUDIT_SADDR_FAM, adding the command line option "saddr_fam" to auditctl. See: https://github.com/linux-audit/audit-kernel/issues/64 See: https://github.com/linux-audit/audit-userspace/issues/93 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- lib/errormsg.h | 2 ++ lib/fieldtab.h | 1 + lib/libaudit.c | 6 ++++++ lib/libaudit.h | 3 +++ 4 files changed, 12 insertions(+) diff --git a/lib/errormsg.h b/lib/errormsg.h index fd8c4a4b1311..fc03b2475034 100644 --- a/lib/errormsg.h +++ b/lib/errormsg.h @@ -70,6 +70,7 @@ struct msg_tab { #define EAU_FIELDUNAVAIL 34 #define EAU_FILTERNOSUPPORT 35 #define EAU_FSTYPEUNKNOWN 36 +#define EAU_FIELDVALTOOBIG 37 static const struct msg_tab err_msgtab[] = { { -EAU_OPMISSING, 2, "-F missing operation for" }, { -EAU_FIELDUNKNOWN, 2, "-F unknown field:" }, @@ -107,5 +108,6 @@ static const struct msg_tab err_msgtab[] = { { -EAU_FIELDUNAVAIL, 1, "field is not valid for the filter" }, { -EAU_FILTERNOSUPPORT, 1, "filter is not supported by the kernel" }, { -EAU_FSTYPEUNKNOWN, 2, "file system type is unknown for field:" }, + { -EAU_FIELDVALTOOBIG, 2, "value is too large for field:" }, }; #endif diff --git a/lib/fieldtab.h b/lib/fieldtab.h index c425d5b86049..b597cafb2df8 100644 --- a/lib/fieldtab.h +++ b/lib/fieldtab.h @@ -69,3 +69,4 @@ _S(AUDIT_ARG3, "a3" ) _S(AUDIT_FILTERKEY, "key" ) _S(AUDIT_EXE, "exe" ) +_S(AUDIT_SADDR_FAM, "saddr_fam" ) diff --git a/lib/libaudit.c b/lib/libaudit.c index 2af017a0e520..2e4b148edde9 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -40,6 +40,7 @@ #include <limits.h> /* for PATH_MAX */ #include <sys/stat.h> #include <sys/types.h> +#include <sys/socket.h> /* AF_MAX */ #ifdef HAVE_LIBCAP_NG #include <cap-ng.h> #endif @@ -1742,6 +1743,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, else if (strcmp(v, "unset") == 0) rule->values[rule->field_count] = 4294967295; break; + case AUDIT_SADDR_FAM: + rule->values[rule->field_count] = strtoul(v, NULL, 0); + if (rule->values[rule->field_count] >= AF_MAX) + return -EAU_FIELDVALTOOBIG; + break; case AUDIT_DEVMAJOR...AUDIT_INODE: case AUDIT_SUCCESS: if (flags != AUDIT_FILTER_EXIT) diff --git a/lib/libaudit.h b/lib/libaudit.h index 77e4142beea2..89fe4839a69b 100644 --- a/lib/libaudit.h +++ b/lib/libaudit.h @@ -356,6 +356,9 @@ extern "C" { #ifndef AUDIT_EXE #define AUDIT_EXE 112 #endif +#ifndef AUDIT_SADDR_FAM +#define AUDIT_SADDR_FAM 113 +#endif #ifndef AUDIT_SESSIONID #define AUDIT_SESSIONID 25 -- 1.8.3.1