lkml.org 
[lkml]   [2014]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/2] Syscall auditing lite
Date
I've made no secret of the fact that I dislike syscall auditing.  As far
as I can tell, the main technical (i.e. not compliance-related) use of
syscall auditing is to supply some useful context information to go
along with events like AVC denials.

CONFIG_AUDITSYSCALL is serious overkill to do this. kernel/auditsc.c is
~2500 lines of terror.

This patchset accomplishes the same goal, more usefully, with no
overhead at all, in under 70 lines of code. It tries to coexist cleanly
with CONFIG_AUDITSYSCALL.

This is only implemented for x86. Other architectures can add support
fairly easily, I think.

Andy Lutomirski (2):
x86,syscall: Add syscall_in_syscall to test whether we're in a syscall
audit: Syscall auditing lite

arch/x86/Kconfig | 1 +
arch/x86/include/asm/syscall.h | 21 ++++++++++++++++++++
init/Kconfig | 3 +++
kernel/audit.c | 44 +++++++++++++++++++++++++++++++++++++++++-
4 files changed, 68 insertions(+), 1 deletion(-)

--
1.9.3



\
 
 \ /
  Last update: 2014-05-31 00:41    [from the cache]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog