[PATCH] audit signal recipients

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Amy Griffis
2007-03-29 18:01:04 -04:00
committed by Al Viro
parent 7f13da40e3
commit e54dc2431d
11 changed files with 206 additions and 29 deletions

View File

@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
~0U
};
int audit_classify_arch(int arch)
{
#ifdef CONFIG_SPARC32_COMPAT
if (arch == AUDIT_ARCH_SPARC)
return 1;
#endif
return 0;
}
int audit_classify_syscall(int abi, unsigned syscall)
{
#ifdef CONFIG_SPARC32_COMPAT