lkml.org 
[lkml]   [2006]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC][PATCH 9/11] security: AppArmor - Audit changes
Tony Jones wrote:     [Wed Apr 19 2006, 01:50:18PM EDT]
> This patch adds AppArmor support to the audit subsystem.
>
> It creates id 1500 (already included in the the upstream auditd package) for
> AppArmor messages.
>
> It also exports the audit_log_vformat function (analagous to having both
> printk and vprintk exported).

linux-audit (cc'd) will likely want to review these changes.

>
> Signed-off-by: Tony Jones <tonyj@suse.de>
>
> ---
> include/linux/audit.h | 5 +++++
> kernel/audit.c | 3 ++-
> 2 files changed, 7 insertions(+), 1 deletion(-)
>
> --- linux-2.6.17-rc1.orig/include/linux/audit.h
> +++ linux-2.6.17-rc1/include/linux/audit.h
> @@ -95,6 +95,8 @@
> #define AUDIT_LAST_KERN_ANOM_MSG 1799
> #define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
>
> +#define AUDIT_AA 1500 /* AppArmor audit */
> +
> #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
>
> /* Rule flags */
> @@ -349,6 +351,9 @@
> __attribute__((format(printf,4,5)));
>
> extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
> +extern void audit_log_vformat(struct audit_buffer *ab,
> + const char *fmt, va_list args)
> + __attribute__((format(printf,2,0)));
> extern void audit_log_format(struct audit_buffer *ab,
> const char *fmt, ...)
> __attribute__((format(printf,2,3)));
> --- linux-2.6.17-rc1.orig/kernel/audit.c
> +++ linux-2.6.17-rc1/kernel/audit.c
> @@ -797,7 +797,7 @@
> * will be called a second time. Currently, we assume that a printk
> * can't format message larger than 1024 bytes, so we don't either.
> */
> -static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
> +void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
> va_list args)
> {
> int len, avail;
> @@ -999,4 +999,5 @@
> EXPORT_SYMBOL(audit_log_start);
> EXPORT_SYMBOL(audit_log_end);
> EXPORT_SYMBOL(audit_log_format);
> +EXPORT_SYMBOL(audit_log_vformat);
> EXPORT_SYMBOL(audit_log);
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-21 23:23    [W:0.318 / U:0.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site