Skip to content

signal audit (v3)

Amy Griffis linux-audit 1 version New

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 0 repliesNew

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2add SIGNAL syscall class (v3)arch/ia64/ia32/audit.c arch/ia64/kernel/audit.c arch/powerpc/kernel/audit.c +10 more+76 -00 replies
2/2audit signal recipients (v3)arch/ia64/kernel/audit.c arch/powerpc/kernel/audit.c arch/s390/kernel/audit.c +8 more+208 -320 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/2] signal audit (v3)

Several changes since last version:
- use arch rule field to determine which signal class to check, check both if arch is unspecified
- don't check AUDIT_CLASS_SIGNAL_32 if it doesn't exist
- group target pids in aux structs (initially 16)
- on syscall exit, initialize context's aux ptrs for re-use
- don't convert sid to string until we log a record

Applies on top of ptrace patch.

Read the cover letter in its thread