Messages in this thread | | | From | Paul Moore <> | Date | Mon, 15 Apr 2019 18:28:09 -0400 | Subject | Re: [PATCH ghak10 v8 1/2] timekeeping: Audit clock adjustments |
| |
On Wed, Apr 10, 2019 at 5:14 AM Ondrej Mosnacek <omosnace@redhat.com> wrote: > > Emit an audit record whenever the system clock is changed (i.e. shifted > by a non-zero offset) by a syscall from userspace. The syscalls than can > (at the time of writing) trigger such record are: > - settimeofday(2), stime(2), clock_settime(2) -- via > do_settimeofday64() > - adjtimex(2), clock_adjtime(2) -- via do_adjtimex() > > The new records have type AUDIT_TIME_INJOFFSET and contain the following > fields: > - sec -- the 'seconds' part of the offset > - nsec -- the 'nanoseconds' part of the offset > > Example record (time was shifted backwards by ~15.875 seconds): > > type=TIME_INJOFFSET msg=audit(1530616049.652:13): sec=-16 nsec=124887145 > > The records of this type will be associated with the corresponding > syscall records. > > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> > Reviewed-by: Richard Guy Briggs <rgb@redhat.com> > Reviewed-by: Thomas Gleixner <tglx@linutronix.de> > --- > include/linux/audit.h | 14 ++++++++++++++ > include/uapi/linux/audit.h | 1 + > kernel/auditsc.c | 6 ++++++ > kernel/time/timekeeping.c | 6 ++++++ > 4 files changed, 27 insertions(+)
Merged into audit/next, thanks everyone.
Ondrej, please watch your line lengths, I had to break up another line greater than 80 chars.
-- paul moore www.paul-moore.com
| |