the loginuid field should be output in all AUDIT_CONFIG_CHANGE audit messages
PATCH 1/1 the loginuid field should be output in all AUDIT_CONFIG_CHANGE audit messages
In the audit message which type is "AUDIT_CONFIG_CHANGE", the output format should contain "auid" field.
Signed-off-by Zhang Xiliang <[email protected]>
--- kernel/auditfilter.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)
kernel/auditfilter.c +4 -2
@@ -1022,8 +1022,9 @@ static void audit_update_watch(struct audit_parent *parent,struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); +audit_log_format (ab,"auid=%u" , current->loginuid);audit_log_format (ab, -"op=updated rules specifying path=" ); +" op=updated rules specifying path=" );audit_log_untrustedstring (ab, owatch->path);audit_log_format (ab," with dev=%u ino=%lu\n" , dev, ino);
@@ -1058,7 +1059,8 @@ static void audit_remove_parent_watches(struct audit_parent *parent)struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); -audit_log_format (ab,"op=remove rule path=" ); +audit_log_format (ab,"auid=%u" , current->loginuid); +audit_log_format (ab," op=remove rule path=" );audit_log_untrustedstring (ab, w->path);if (r->filterkey) {audit_log_format (ab," key=" );
Signature · 6 lines
1.5.4.2 -- Regards Zhang Xiliang
Eric Paris
maintainerQuoted 1 line · zhangxiliang
In the audit message which type is "
AUDIT_CONFIG_CHANGE", the output format should contain "auid" field.
shouldn't these be using the "audit_get_loginuid(current)" and if we are going to output loginuid we also should be outputting sessionid
-Eric
Quoted 35 lines
Signed-off-by Zhang Xiliang <[email protected]>--- kernel/auditfilter.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)kernel/auditfilter.c +4
-2@@ -1022,8 +1022,9 @@ static void audit_update_watch(struct audit_parent *parent,struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); +audit_log_format (ab,"auid=%u" , current->loginuid);audit_log_format (ab, -"op=updated rules specifying path=" ); +" op=updated rules specifying path=" );audit_log_untrustedstring (ab, owatch->path);audit_log_format (ab," with dev=%u ino=%lu\n" , dev, ino);@@ -1058,7 +1059,8 @@ static void audit_remove_parent_watches(struct audit_parent *parent)struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); -audit_log_format (ab,"op=remove rule path=" ); +audit_log_format (ab,"auid=%u" , current->loginuid); +audit_log_format (ab," op=remove rule path=" );audit_log_untrustedstring (ab, w->path);if (r->filterkey) {audit_log_format (ab," key=" );Signature · 1 line
1.5.4.2
Quoted 2 lines
shouldn't these be using the "
audit_get_loginuid(current)" and if we are going to output loginuid we also should be outputting sessionid
Thanks for your detailed explanation.
I have made a new patch for outputing "loginuid" and "sessionid" by audit_get_loginuid(current) and audit_get_sessionid(current). If there are some deficiencies, please give me your indication.
Signed-off-by Zhang Xiliang <[email protected]>
--- kernel/auditfilter.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
kernel/auditfilter.c +8 -2
@@ -1022,8 +1022,11 @@ static void audit_update_watch(struct audit_parent *parent,struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); +audit_log_format (ab,"auid=%u ses=%u" , +audit_get_loginuid (current), +audit_get_sessionid (current));audit_log_format (ab, -"op=updated rules specifying path=" ); +" op=updated rules specifying path=" );audit_log_untrustedstring (ab, owatch->path);audit_log_format (ab," with dev=%u ino=%lu\n" , dev, ino);
@@ -1058,7 +1061,10 @@ static void audit_remove_parent_watches(struct audit_parent *parent)struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); -audit_log_format (ab,"op=remove rule path=" ); +audit_log_format (ab,"auid=%u ses=%u" , +audit_get_loginuid (current), +audit_get_sessionid (current)); +audit_log_format (ab," op=remove rule path=" );audit_log_untrustedstring (ab, w->path);if (r->filterkey) {audit_log_format (ab," key=" );
Signature · 7 lines
1.5.4.2 Regards Zhang Xiliang Eric Paris said the following on 2008-08-01 1:42:
Quoted 46 lines · zhangxiliang
Quoted 1 line
In the audit message which type is "
AUDIT_CONFIG_CHANGE", the output format should contain "auid" field.shouldn't these be using the "
audit_get_loginuid(current)" and if we are going to output loginuid we also should be outputting sessionid-Eric
Quoted 34 lines
Signed-off-by Zhang Xiliang <[email protected]>--- kernel/auditfilter.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)kernel/auditfilter.c +4
-2@@ -1022,8 +1022,9 @@ static void audit_update_watch(struct audit_parent *parent,struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); +audit_log_format (ab,"auid=%u" , current->loginuid);audit_log_format (ab, -"op=updated rules specifying path=" ); +" op=updated rules specifying path=" );audit_log_untrustedstring (ab, owatch->path);audit_log_format (ab," with dev=%u ino=%lu\n" , dev, ino);@@ -1058,7 +1059,8 @@ static void audit_remove_parent_watches(struct audit_parent *parent)struct audit_buffer *ab; ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_CONFIG_CHANGE ); -audit_log_format (ab,"op=remove rule path=" ); +audit_log_format (ab,"auid=%u" , current->loginuid); +audit_log_format (ab," op=remove rule path=" );audit_log_untrustedstring (ab, w->path);if (r->filterkey) {audit_log_format (ab," key=" );Signature · 1 line
1.5.4.2