lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fs: add link restriction audit reporting

Browse Source 
Adds audit messages for unexpected link restriction violations so that
system owners will have some sort of potentially actionable information
about misbehaving processes.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Kees Cook
2012-07-25 17:29:08 -07:00
committed by Al Viro
parent 800179c9b8
commit a51d9eaa41
3 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
kernel/audit.c
View File

@@ -1449,6 +1449,27 @@ void audit_log_key(struct audit_buffer *ab, char *key)
audit_log_format(ab, "(null)");
}
/**
* audit_log_link_denied - report a link restriction denial
* @operation: specific link opreation
* @link: the path that triggered the restriction
*/
void audit_log_link_denied(const char *operation, struct path *link)
{
struct audit_buffer *ab;
ab = audit_log_start(current->audit_context, GFP_KERNEL,
AUDIT_ANOM_LINK);
audit_log_format(ab, "op=%s action=denied", operation);
audit_log_format(ab, " pid=%d comm=", current->pid);
audit_log_untrustedstring(ab, current->comm);
audit_log_d_path(ab, " path=", link);
audit_log_format(ab, " dev=");
audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino);
audit_log_end(ab);
}
/**
* audit_log_end - end one audit record
* @ab: the audit_buffer