[PATCH] audit signal recipients
When auditing syscalls that send signals, log the pid and security context for each target process. Optimize the data collection by adding a counter for signal-related rules, and avoiding allocating an aux struct unless we have more than one target process. For process groups, collect pid/context data in blocks of 16. Move the audit_signal_info() hook up in check_kill_permission() so we audit attempts where permission is denied. Signed-off-by: Amy Griffis <amy.griffis@hp.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
|
||||
~0U
|
||||
};
|
||||
|
||||
int audit_classify_arch(int arch)
|
||||
{
|
||||
#ifdef CONFIG_SPARC32_COMPAT
|
||||
if (arch == AUDIT_ARCH_SPARC)
|
||||
return 1;
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
int audit_classify_syscall(int abi, unsigned syscall)
|
||||
{
|
||||
#ifdef CONFIG_SPARC32_COMPAT
|
||||
|
Reference in New Issue
Block a user