korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-25 05:04:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

audit: allow audit matching on inode gid

Browse Source 
Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris 2012-01-03 14:23:07 -05:00 committed by Al Viro
parent efaffd6e44
commit 54d3218b31
3 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/audit.h
View File

@ -224,6 +224,7 @@
#define AUDIT_DIR 107 #define AUDIT_DIR 107
#define AUDIT_FILETYPE 108 #define AUDIT_FILETYPE 108
#define AUDIT_OBJ_UID 109 #define AUDIT_OBJ_UID 109
#define AUDIT_OBJ_GID 110
#define AUDIT_ARG0 200 #define AUDIT_ARG0 200
#define AUDIT_ARG1 (AUDIT_ARG0+1) #define AUDIT_ARG1 (AUDIT_ARG0+1)

1
kernel/auditfilter.c
View File

@ -462,6 +462,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
case AUDIT_ARG2: case AUDIT_ARG2:
case AUDIT_ARG3: case AUDIT_ARG3:
case AUDIT_OBJ_UID: case AUDIT_OBJ_UID:
case AUDIT_OBJ_GID:
break; break;
case AUDIT_ARCH: case AUDIT_ARCH:
entry->rule.arch_f = f; entry->rule.arch_f = f;

12
kernel/auditsc.c
View File

@ -598,6 +598,18 @@ static int audit_filter_rules(struct task_struct *tsk,
} }
} }
break; break;
case AUDIT_OBJ_GID:
if (name) {
result = audit_comparator(name->gid, f->op, f->val);
} else if (ctx) {
list_for_each_entry(n, &ctx->names_list, list) {
if (audit_comparator(n->gid, f->op, f->val)) {
++result;
break;
}
}
}
break;
case AUDIT_WATCH: case AUDIT_WATCH:
if (name) if (name)
result = audit_watch_compare(rule->watch, name->ino, name->dev); result = audit_watch_compare(rule->watch, name->ino, name->dev);