fanotify: Allow audit to use the full permission event response

PATCH In review Steve Grubb 1 participant 1 message Sep 30, 2020

Subsystems (4)

VFS Audit Fsnotify: filesystem notification infrastructure Fanotify

lore

Share & tools

lore

Steve Grubb

author

2020-09-30 16:12 UTC #0 lore raw

PATCH 3/3 fanotify: Allow audit to use the full permission event response

This patch unmasks the full value so that the audit function can use all of it. The audit function was updated to log the additional information in the AUDIT_FANOTIFY record. The following is an example of the new record format:

type=FANOTIFY msg=audit(1600385147.372:590): resp=2 ctx_type=1 fan_ctx=17

Signed-off-by Steve Grubb <[email protected]>

---
 fs/notify/fanotify/fanotify.c | 2 +-
 kernel/auditsc.c              | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

fs/notify/fanotify/fanotify.c +1 -1

index e72b7e59aa24..a9278e983e30 100644
@@ -188,7 +188,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
 
 	/* Check if the response should be audited */
 	if (event->response & FAN_AUDIT)
-		audit_fanotify(event->response & ~FAN_AUDIT);
+		audit_fanotify(event->response);
 
 	pr_debug("%s: group=%p event=%p about to return ret=%d\n", __func__,
 		 group, event, ret);

kernel/auditsc.c +5 -2

index fd840c40abf7..9d6a3ad2037d 100644
@@ -75,6 +75,7 @@
 #include <linux/uaccess.h>
 #include <linux/fsnotify_backend.h>
 #include <uapi/linux/limits.h>
+#include <uapi/linux/fanotify.h>
 
 #include "audit.h"

@@ -2523,8 +2524,10 @@ void __audit_log_kern_module(char *name)
 
 void __audit_fanotify(unsigned int response)
 {
-	audit_log(audit_context(), GFP_KERNEL,
-		AUDIT_FANOTIFY,	"resp=%u", response);
+	audit_log(audit_context(), GFP_KERNEL, AUDIT_FANOTIFY,
+		"resp=%u ctx_type=%u fan_ctx=%u", FAN_DEC_MASK(response),
+		FAN_DEC_CONTEXT_TYPE_TO_VALUE(response),
+		FAN_DEC_CONTEXT_TO_VALUE(response));
 }
 
 void __audit_tk_injoffset(struct timespec64 offset)

Signature · 1 line

2.26.2