Files
kernel/include/linux
Amy Griffis 9c937dcc71 [PATCH] log more info for directory entry change events
When an audit event involves changes to a directory entry, include
a PATH record for the directory itself.  A few other notable changes:

    - fixed audit_inode_child() hooks in fsnotify_move()
    - removed unused flags arg from audit_inode()
    - added audit log routines for logging a portion of a string

Here's some sample output.

before patch:
type=SYSCALL msg=audit(1149821605.320:26): arch=40000003 syscall=39 success=yes exit=0 a0=bf8d3c7c a1=1ff a2=804e1b8 a3=bf8d3c7c items=1 ppid=739 pid=800 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149821605.320:26):  cwd="/root"
type=PATH msg=audit(1149821605.320:26): item=0 name="foo" parent=164068 inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

after patch:
type=SYSCALL msg=audit(1149822032.332:24): arch=40000003 syscall=39 success=yes exit=0 a0=bfdd9c7c a1=1ff a2=804e1b8 a3=bfdd9c7c items=2 ppid=714 pid=777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149822032.332:24):  cwd="/root"
type=PATH msg=audit(1149822032.332:24): item=0 name="/root" inode=164068 dev=03:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_dir_t:s0
type=PATH msg=audit(1149822032.332:24): item=1 name="foo" inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-06-20 05:25:28 -04:00
..
2006-03-21 08:52:18 -08:00
2006-03-31 12:18:48 -08:00
2006-03-24 07:33:20 -08:00
2006-03-28 09:16:05 -08:00
2006-03-23 07:38:09 -08:00
2006-03-27 08:44:59 -08:00
2006-03-27 08:44:59 -08:00
2006-06-08 15:14:23 -07:00
2006-03-31 12:18:54 -08:00
2006-04-02 00:08:05 -05:00
2006-04-11 06:18:35 -07:00
2006-03-26 08:56:56 -08:00
2006-03-27 08:44:51 -08:00
2006-03-20 17:09:11 -08:00
2006-03-20 22:41:23 -08:00
2006-02-01 08:53:13 -08:00
2006-02-08 01:03:52 -05:00
2006-03-26 08:56:56 -08:00
2006-03-20 22:21:10 -08:00
2006-04-27 13:08:56 -07:00
2006-03-23 07:38:12 -08:00
2006-04-29 18:33:15 -07:00
2006-03-23 07:38:12 -08:00
2006-06-05 12:29:17 -07:00
2006-03-22 07:53:57 -08:00
2006-06-05 12:29:16 -07:00
2006-03-23 07:38:13 -08:00
2006-03-23 07:38:14 -08:00
2006-03-23 07:38:14 -08:00
2006-03-20 13:44:40 -05:00
2006-03-20 13:44:27 -05:00
2006-04-11 06:18:39 -07:00
2006-05-22 13:56:02 -04:00
2006-03-08 14:14:01 -08:00
2006-03-27 08:44:48 -08:00
2006-05-04 06:55:12 +02:00
2006-03-25 08:22:51 -08:00
2006-03-25 08:22:53 -08:00
2006-03-27 08:44:51 -08:00
2006-05-01 06:09:56 -04:00
2006-03-23 07:38:12 -08:00
2006-04-02 00:08:05 -05:00
2006-03-20 22:41:23 -08:00
2006-03-28 09:16:05 -08:00
2006-03-26 08:57:03 -08:00
2006-03-31 12:18:56 -08:00
2006-03-23 07:38:11 -08:00
2006-03-26 08:57:00 -08:00
2006-03-23 07:38:14 -08:00
2006-03-28 09:16:05 -08:00
2006-03-23 07:12:57 -05:00