linux/kernel/auditsc.c, branch v2.6.13

AUDIT: Record working directory when syscall arguments are pathnames

2005-05-27T11:17:28Z

Signed-off-by: David Woodhouse

AUDIT: Defer freeing aux items until audit_free_context()

2005-05-26T11:04:57Z

While they were all just simple blobs it made sense to just free them as we walked through and logged them. Now that there are pointers to other objects which need refcounting, we might as well revert to _only_ logging them in audit_log_exit(), and put the code to free them properly in only one place -- in audit_free_aux(). Signed-off-by: David Woodhouse ----------------------------------------------------------

AUDIT: Escape comm when logging task info

2005-05-23T20:57:41Z

It comes from the user; it needs to be escaped. Signed-off-by: David Woodhouse

AUDIT: Unify auid reporting, put arch before syscall number

2005-05-23T20:35:28Z

These changes make processing of audit logs easier. Based on a patch from Steve Grubb Signed-off-by: David Woodhouse

AUDIT: Assign serial number to non-syscall messages

2005-05-21T20:08:09Z

Move audit_serial() into audit.c and use it to generate serial numbers on messages even when there is no audit context from syscall auditing. This allows us to disambiguate audit records when more than one is generated in the same millisecond. Based on a patch by Steve Grubb after he observed the problem. Signed-off-by: David Woodhouse

AUDIT: Fix inconsistent use of loginuid vs. auid, signed vs. unsigned

2005-05-20T23:22:31Z

The attached patch changes all occurrences of loginuid to auid. It also changes everything to %u that is an unsigned type. Signed-off-by: Steve Grubb Signed-off-by: David Woodhouse

AUDIT: Avoid sleeping function in SElinux AVC audit.

2005-05-20T23:15:52Z

This patch changes the SELinux AVC to defer logging of paths to the audit framework upon syscall exit, by saving a reference to the (dentry,vfsmount) pair in an auxiliary audit item on the current audit context for processing by audit_log_exit. Signed-off-by: Stephen Smalley Signed-off-by: David Woodhouse

AUDIT: Quis Custodiet Ipsos Custodes?

2005-05-19T10:23:13Z

Nobody does. Really, it gets very silly if auditd is recording its own actions. Signed-off-by: David Woodhouse

AUDIT: Capture sys_socketcall arguments and sockaddrs

2005-05-17T11:08:48Z

Signed-off-by: David Woodhouse

AUDIT: Fix some spelling errors

2005-05-13T17:35:15Z

I'm going through the kernel code and have a patch that corrects several spelling errors in comments. From: Steve Grubb Signed-off-by: David Woodhouse