linux/kernel/auditsc.c, branch v2.6.28

[PATCH] fix broken timestamps in AVC generated by kernel threads

2008-12-09T07:27:41Z

Timestamp in audit_context is valid only if ->in_syscall is set. Signed-off-by: Al Viro

[patch 1/1] audit: remove excess kernel-doc

2008-12-09T07:27:40Z

Delete excess kernel-doc notation in kernel/auditsc.c: Warning(linux-2.6.27-git10//kernel/auditsc.c:1481): Excess function parameter or struct member 'tsk' description in 'audit_syscall_entry' Warning(linux-2.6.27-git10//kernel/auditsc.c:1564): Excess function parameter or struct member 'tsk' description in 'audit_syscall_exit' Signed-off-by: Randy Dunlap Cc: Al Viro Cc: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Al Viro

[PATCH] return records for fork() both to child and parent

2008-12-09T07:27:38Z

Signed-off-by: Al Viro

tty: Fix abusers of current->sighand->tty

2008-10-13T16:51:42Z

Various people outside the tty layer still stick their noses in behind the scenes. We need to make sure they also obey the locking and referencing rules. Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds

[PATCH] audit: Moved variable declaration to beginning of function

2008-09-02T03:06:45Z

got rid of compilation warning: ISO C90 forbids mixed declarations and code Signed-off-by: Cordelia Sam Signed-off-by: Al Viro

Re: [PATCH] Fix the kernel panic of audit_filter_task when key field is set

2008-08-04T10:13:50Z

Sorry, I miss a blank between if and "(". And I add "unlikely" to check "ctx" in audit_match_perm() and audit_match_filetype(). This is a new patch for it. Signed-off-by: Zhang Xiliang Signed-off-by: Al Viro

[PATCH] Fix the kernel panic of audit_filter_task when key field is set

2008-08-01T16:15:03Z

When calling audit_filter_task(), it calls audit_filter_rules() with audit_context is NULL. If the key field is set, the result in audit_filter_rules() will be set to 1 and ctx->filterkey will be set to key. But the ctx is NULL in this condition, so kernel will panic. Signed-off-by: Zhang Xiliang Signed-off-by: Al Viro

[PATCH] Audit: Collect signal info when SIGUSR2 is sent to auditd

2008-08-01T16:05:32Z

Makes the kernel audit subsystem collect information about the sending process when that process sends SIGUSR2 to the userspace audit daemon. SIGUSR2 is a new interesting signal to auditd telling auditd that it should try to start logging to disk again and the error condition which caused it to stop logging to disk (usually out of space) has been rectified. Signed-off-by: Eric Paris Signed-off-by: Al Viro

x86_64 syscall audit fast-path

2008-07-24T00:47:32Z

This adds a fast path for 64-bit syscall entry and exit when TIF_SYSCALL_AUDIT is set, but no other kind of syscall tracing. This path does not need to save and restore all registers as the general case of tracing does. Avoiding the iret return path when syscall audit is enabled helps performance a lot. Signed-off-by: Roland McGrath

[PATCH] new predicate - AUDIT_FILETYPE

2008-04-28T10:28:37Z

Argument is S_IF... | , where index is normally 0 or 1. Triggers if chosen element of ctx->names[] is present and the mode of object in question matches the upper bits of argument. I.e. for things like "is the argument of that chmod a directory", etc. Signed-off-by: Al Viro