linux/kernel/auditsc.c, branch v2.6.30

Audit: remove spaces from audit_log_d_path

2009-04-05T17:49:04Z

audit_log_d_path had spaces in the strings which would be emitted on the error paths. This patch simply replaces those spaces with an _ or removes the needless spaces entirely. Signed-off-by: Eric Paris Signed-off-by: Al Viro

audit: audit_set_auditable defined but not used

2009-04-05T17:48:52Z

after 0590b9335a1c72a3f0defcc6231287f7817e07c8 audit_set_auditable() is now only used by the audit tree code. If CONFIG_AUDIT_TREE is unset it will be defined but unused. This patch simply moves the function inside a CONFIG_AUDIT_TREE block. cc1: warnings being treated as errors /home/acme_unencrypted/git/linux-2.6-tip/kernel/auditsc.c:745: error: ‘audit_set_auditable’ defined but not used make[2]: *** [kernel/auditsc.o] Error 1 make[1]: *** [kernel] Error 2 make[1]: *** Waiting for unfinished jobs.... Signed-off-by: Eric Paris Signed-off-by: Al Viro

audit: Fix possible return value truncation in audit_get_context()

2009-04-05T17:46:19Z

The audit subsystem treats syscall return codes as type long, unfortunately the audit_get_context() function mistakenly converts the return code to an int type in the parameters which could cause problems on systems where the sizeof(int) != sizeof(long). Signed-off-by: Paul Moore Signed-off-by: Al Viro

auditsc: fix kernel-doc notation

2009-04-05T17:39:19Z

Fix auditsc kernel-doc notation: Warning(linux-2.6.28-git7//kernel/auditsc.c:2156): No description found for parameter 'attr' Warning(linux-2.6.28-git7//kernel/auditsc.c:2156): Excess function parameter 'u_attr' description in '__audit_mq_open' Warning(linux-2.6.28-git7//kernel/auditsc.c:2204): No description found for parameter 'notification' Warning(linux-2.6.28-git7//kernel/auditsc.c:2204): Excess function parameter 'u_notification' description in '__audit_mq_notify' Signed-off-by: Randy Dunlap cc: Al Viro cc: Eric Paris Signed-off-by: Al Viro

audit: EXECVE record - removed bogus newline

2009-04-05T17:38:59Z

(updated) Added hunk that changes the comment, the rest is the same. EXECVE records contain a newline after every argument. auditd converts "\n" to " " so you cannot see newlines even in raw logs, but they're there nevertheless. If you're not using auditd, you need to work round them. These '\n' chars are can be easily replaced by spaces when creating record in kernel. Note there is no need for trailing '\n' in an audit record. record before this patch: "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\"\na1=\"a\"\na2=\"b\"\na3=\"c\"\n" record after this patch: "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\" a1=\"a\" a2=\"b\" a3=\"c\"" Signed-off-by: Jiri Pirko Acked-by: Eric Paris Signed-off-by: Al Viro

Get rid of indirect include of fs_struct.h

2009-04-01T03:00:27Z

Don't pull it in sched.h; very few files actually need it and those can include directly. sched.h itself only needs forward declaration of struct fs_struct; Signed-off-by: Al Viro

make sure that filterkey of task,always rules is reported

2009-01-04T20:14:42Z

Signed-off-by: Al Viro

fixing audit rule ordering mess, part 1

2009-01-04T20:14:41Z

Problem: ordering between the rules on exit chain is currently lost; all watch and inode rules are listed after everything else _and_ exit,never on one kind doesn't stop exit,always on another from being matched. Solution: assign priorities to rules, keep track of the current highest-priority matching rule and its result (always/never). Signed-off-by: Al Viro

sanitize audit_log_capset()

2009-01-04T20:14:41Z

* no allocations * return void * don't duplicate checked for dummy context Signed-off-by: Al Viro

sanitize audit_fd_pair()

2009-01-04T20:14:41Z

* no allocations * return void Signed-off-by: Al Viro