Messages in this thread | | | From | Paul Moore <> | Date | Fri, 21 May 2021 16:19:26 -0400 | Subject | Re: [PATCH v26 21/25] audit: add support for non-syscall auxiliary records |
| |
On Thu, May 13, 2021 at 4:31 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > Standalone audit records have the timestamp and serial number generated > on the fly and as such are unique, making them standalone. This new > function audit_alloc_local() generates a local audit context that will > be used only for a standalone record and its auxiliary record(s). The > context is discarded immediately after the local associated records are > produced. > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> > Cc: linux-audit@redhat.com > To: Richard Guy Briggs <rgb@redhat.com> > --- > include/linux/audit.h | 8 ++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- > 3 files changed, 37 insertions(+), 5 deletions(-)
At some point I suspect we will need to add filtering for these "local" records, but that is a problem for another day.
Acked-by: Paul Moore <paul@paul-moore.com>
-- paul moore www.paul-moore.com
| |