)]}' { "log": [ { "commit": "4259fa01a2d2aa3e589b34ba7624080232d9c1ff", "tree": "3aa83d784c4db22f3b62e4d963757497555c5e5c", "parents": [ "74f2345b6be1410f824cb7dd638d2c10a9709379" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Jun 07 11:13:31 2007 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 22 09:57:02 2007 -0400" }, "message": "[PATCH] get rid of AVC_PATH postponed treatment\n\n Selinux folks had been complaining about the lack of AVC_PATH\nrecords when audit is disabled. I must admit my stupidity - I assumed\nthat avc_audit() really couldn\u0027t use audit_log_d_path() because of\ndeadlocks (\u003d\u003d could be called with dcache_lock or vfsmount_lock held).\nShouldn\u0027t have made that assumption - it never gets called that way.\nIt _is_ called under spinlocks, but not those.\n\n Since audit_log_d_path() uses ab-\u003egfp_mask for allocations,\nkmalloc() in there is not a problem. IOW, the simple fix is sufficient:\nlet\u0027s rip AUDIT_AVC_PATH out and simply generate pathname as part of main\nrecord. It\u0027s trivial to do.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "5b9a4262232d632c28990fcdf4f36d0e0ade5f18", "tree": "1ced97f3605de37877045747cc4bb37c0c759509", "parents": [ "d7fff6f4d1ed1bc31577df887fefcb1541923367" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Tue May 29 10:38:18 2007 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 22 09:57:02 2007 -0400" }, "message": "[PATCH] Make IPC mode consistent\n\nThe mode fields for IPC records are not consistent. Some are hex, others are\noctal. This patch makes them all octal.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "b6a2fea39318e43fee84fa7b0b90d68bed92d2ba", "tree": "c9c3619cb2730b5c10c7427b837146bce3d69156", "parents": [ "bdf4c48af20a3b0f01671799ace345e3d49576da" ], "author": { "name": "Ollie Wild", "email": "aaw@google.com", "time": "Thu Jul 19 01:48:16 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Thu Jul 19 10:04:45 2007 -0700" }, "message": "mm: variable length argument support\n\nRemove the arg+env limit of MAX_ARG_PAGES by copying the strings directly from\nthe old mm into the new mm.\n\nWe create the new mm before the binfmt code runs, and place the new stack at\nthe very top of the address space. Once the binfmt code runs and figures out\nwhere the stack should be, we move it downwards.\n\nIt is a bit peculiar in that we have one task with two mm\u0027s, one of which is\ninactive.\n\n[a.p.zijlstra@chello.nl: limit stack size]\nSigned-off-by: Ollie Wild \u003caaw@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: \u003clinux-arch@vger.kernel.org\u003e\nCc: Hugh Dickins \u003chugh@veritas.com\u003e\n[bunk@stusta.de: unexport bprm_mm_init]\nSigned-off-by: Adrian Bunk \u003cbunk@stusta.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bdf4c48af20a3b0f01671799ace345e3d49576da", "tree": "7c3b903d2de1cba6e212ad6f347bc8742b08035a", "parents": [ "b111757c50ee30dad162192df6168e270a90c252" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Thu Jul 19 01:48:15 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Thu Jul 19 10:04:45 2007 -0700" }, "message": "audit: rework execve audit\n\nThe purpose of audit_bprm() is to log the argv array to a userspace daemon at\nthe end of the execve system call. Since user-space hasn\u0027t had time to run,\nthis array is still in pristine state on the process\u0027 stack; so no need to\ncopy it, we can just grab it from there.\n\nIn order to minimize the damage to audit_log_*() copy each string into a\ntemporary kernel buffer first.\n\nCurrently the audit code requires that the full argument vector fits in a\nsingle packet. So currently it does clip the argv size to a (sysctl) limit,\nbut only when execve auditing is enabled.\n\nIf the audit protocol gets extended to allow for multiple packets this check\ncan be removed.\n\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Ollie Wild \u003caaw@google.com\u003e\nCc: \u003clinux-audit@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6d9525b52aecd11b14c4ec982add01c11157172f", "tree": "7664b09fdf09adb656e865a055cc2f2532919b77", "parents": [ "dcf5008db171211e3c34c060cacfd788306b034b" ], "author": { "name": "Henrik Kretzschmar", "email": "henne@nachtwindheim.de", "time": "Sun Jul 15 23:41:10 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Jul 16 09:05:48 2007 -0700" }, "message": "kerneldoc fix in audit_core_dumps\n\nFix parameter name in audit_core_dumps for kerneldoc.\n\nSigned-off-by: Henrik Kretzschmar \u003chenne@nachtwindheim.de\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "522ed7767e800cff6c650ec64b0ee0677303119c", "tree": "f65ecb29f2cf885018d3557f840de3ef4be6ec64", "parents": [ "4f27c00bf80f122513d3a5be16ed851573164534" ], "author": { "name": "Miloslav Trmac", "email": "mitr@redhat.com", "time": "Sun Jul 15 23:40:56 2007 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Mon Jul 16 09:05:47 2007 -0700" }, "message": "Audit: add TTY input auditing\n\nAdd TTY input auditing, used to audit system administrator\u0027s actions. This is\nrequired by various security standards such as DCID 6/3 and PCI to provide\nnon-repudiation of administrator\u0027s actions and to allow a review of past\nactions if the administrator seems to overstep their duties or if the system\nbecomes misconfigured for unknown reasons. These requirements do not make it\nnecessary to audit TTY output as well.\n\nCompared to an user-space keylogger, this approach records TTY input using the\naudit subsystem, correlated with other audit events, and it is completely\ntransparent to the user-space application (e.g. the console ioctls still\nwork).\n\nTTY input auditing works on a higher level than auditing all system calls\nwithin the session, which would produce an overwhelming amount of mostly\nuseless audit events.\n\nAdd an \"audit_tty\" attribute, inherited across fork (). Data read from TTYs\nby process with the attribute is sent to the audit subsystem by the kernel.\nThe audit netlink interface is extended to allow modifying the audit_tty\nattribute, and to allow sending explanatory audit events from user-space (for\nexample, a shell might send an event containing the final command, after the\ninteractive command-line editing and history expansion is performed, which\nmight be difficult to decipher from the TTY input alone).\n\nBecause the \"audit_tty\" attribute is inherited across fork (), it would be set\ne.g. for sshd restarted within an audited session. To prevent this, the\naudit_tty attribute is cleared when a process with no open TTY file\ndescriptors (e.g. after daemon startup) opens a TTY.\n\nSee https://www.redhat.com/archives/linux-audit/2007-June/msg00000.html for a\nmore detailed rationale document for an older version of this patch.\n\n[akpm@linux-foundation.org: build fix]\nSigned-off-by: Miloslav Trmac \u003cmitr@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Alan Cox \u003calan@lxorguk.ukuu.org.uk\u003e\nCc: Paul Fulghum \u003cpaulkf@microgate.com\u003e\nCc: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nCc: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0a4ff8c2598b72f2fa9d50aae9e1809e684dbf41", "tree": "309f2b2b5874692302862534cd9052a1d96018ba", "parents": [ "5712e88f2b0f626a4857c24128810bbf8ce09537" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Thu Apr 19 10:28:21 2007 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:26 2007 -0400" }, "message": "[PATCH] Abnormal End of Processes\n\nHi,\n\nI have been working on some code that detects abnormal events based on audit\nsystem events. One kind of event that we currently have no visibility for is\nwhen a program terminates due to segfault - which should never happen on a\nproduction machine. And if it did, you\u0027d want to investigate it. Attached is a\npatch that collects these events and sends them into the audit system.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5712e88f2b0f626a4857c24128810bbf8ce09537", "tree": "1285a3e632e6c3d6dfecc2c3445770a559c712ca", "parents": [ "4fc03b9beb2314f3adb9e72b7935a80c577954d1" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Tue Feb 13 14:15:22 2007 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:26 2007 -0400" }, "message": "[PATCH] match audit name data\n\nMake more effort to detect previously collected names, so we don\u0027t log\nmultiple PATH records for a single filesystem object. Add\naudit_inc_name_count() to reduce duplicate code.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "4fc03b9beb2314f3adb9e72b7935a80c577954d1", "tree": "81e04534c582923fcdc8212497d1487ddae412a8", "parents": [ "510f4006e7a82b37b53c17bbe64ec20f3a59302b" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Tue Feb 13 14:15:01 2007 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:26 2007 -0400" }, "message": "[PATCH] complete message queue auditing\n\nHandle the edge cases for POSIX message queue auditing. Collect inode\ninfo when opening an existing mq, and for send/receive operations. Remove\naudit_inode_update() as it has really evolved into the equivalent of\naudit_inode().\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "e41e8bde43026d5d2e41464e6105a50b31e34102", "tree": "1ba5c647ce69db81d327b0024294445a449cf1c0", "parents": [ "e54dc2431d740a79a6bd013babade99d71b1714f" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Tue Feb 13 14:14:09 2007 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:25 2007 -0400" }, "message": "[PATCH] initialize name osid\n\nAudit contexts can be reused, so initialize a name\u0027s osid to the\ndefault in audit_getname(). This ensures we don\u0027t log a bogus object\nlabel when no inode data is collected for a name.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "e54dc2431d740a79a6bd013babade99d71b1714f", "tree": "16b0990d5c16946239a17b332f54b5918fb03305", "parents": [ "7f13da40e36c84d0d046b7adbd060af7d3717250" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Mar 29 18:01:04 2007 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:25 2007 -0400" }, "message": "[PATCH] audit signal recipients\n\nWhen auditing syscalls that send signals, log the pid and security\ncontext for each target process. Optimize the data collection by\nadding a counter for signal-related rules, and avoiding allocating an\naux struct unless we have more than one target process. For process\ngroups, collect pid/context data in blocks of 16. Move the\naudit_signal_info() hook up in check_kill_permission() so we audit\nattempts where permission is denied.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "a5cb013da773a67ee48d1c19e96436c22a73a7eb", "tree": "8832d105c4742674423bd50352b8a4805c44fecc", "parents": [ "129a84de2347002f09721cda3155ccfd19fade40" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 20 13:58:35 2007 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri May 11 05:38:25 2007 -0400" }, "message": "[PATCH] auditing ptrace\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "c4823bce033be74c0fcfbcae2f1be0854fdc2e18", "tree": "a37dce7574167fc3639b70bab2626bbf8eb896e3", "parents": [ "baab1087c61d4506f2c9f4cdb7da162160de16c2" ], "author": { "name": "Al Viro", "email": "viro@ftp.linux.org.uk", "time": "Mon Mar 12 16:17:42 2007 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Wed Mar 14 15:27:48 2007 -0700" }, "message": "[PATCH] fix deadlock in audit_log_task_context()\n\nGFP_KERNEL allocations in non-blocking context; fixed by killing\nan idiotic use of security_getprocattr().\n\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "db3495099d3d52854b13874905af6e40a91f4721", "tree": "5a832081d70dd9dabda3498baf40b7d6ced47f24", "parents": [ "6a01b07fae482f9b34491b317056c89d3b96ca2e" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Feb 07 01:48:00 2007 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Feb 17 21:30:15 2007 -0500" }, "message": "[PATCH] AUDIT_FD_PAIR\n\nProvide an audit record of the descriptor pair returned by pipe() and\nsocketpair(). Rewritten from the original posted to linux-audit by\nJohn D. Ramsdell \u003cramsdell@mitre.org\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "a7a005fd12b84392becca311f2a20d5bf2a1b7af", "tree": "0baf326ea34bdef38e42a5ae664d348de3c69ae8", "parents": [ "ff273773bfd4f2131bad1318e56519fcceac2339" ], "author": { "name": "Josef Sipek", "email": "jsipek@fsl.cs.sunysb.edu", "time": "Fri Dec 08 02:37:17 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Fri Dec 08 08:28:46 2006 -0800" }, "message": "[PATCH] struct path: convert kernel\n\nSigned-off-by: Josef Sipek \u003cjsipek@fsl.cs.sunysb.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "24ec839c431eb79bb8f6abc00c4e1eb3b8c4d517", "tree": "2ff478b1925159eeac007913c2a8f19d5f5e6010", "parents": [ "562f9c574e0707f9159a729ea41faf53b221cd30" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Dec 08 02:36:04 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.osdl.org", "time": "Fri Dec 08 08:28:38 2006 -0800" }, "message": "[PATCH] tty: -\u003esignal-\u003etty locking\n\nFix the locking of signal-\u003etty.\n\nUse -\u003esighand-\u003esiglock to protect -\u003esignal-\u003etty; this lock is already used\nby most other members of -\u003esignal/-\u003esighand. And unless we are \u0027current\u0027\nor the tasklist_lock is held we need -\u003esiglock to access -\u003esignal anyway.\n\n(NOTE: sys_unshare() is broken wrt -\u003esighand locking rules)\n\nNote that tty_mutex is held over tty destruction, so while holding\ntty_mutex any tty pointer remains valid. Otherwise the lifetime of ttys\nare governed by their open file handles. This leaves some holes for tty\naccess from signal-\u003etty (or any other non file related tty access).\n\nIt solves the tty SLAB scribbles we were seeing.\n\n(NOTE: the change from group_send_sig_info to __group_send_sig_info needs to\n be examined by someone familiar with the security framework, I think\n it is safe given the SEND_SIG_PRIV from other __group_send_sig_info\n invocations)\n\n[schwidefsky@de.ibm.com: 3270 fix]\n[akpm@osdl.org: various post-viro fixes]\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Alan Cox \u003calan@redhat.com\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Chris Wright \u003cchrisw@sous-sol.org\u003e\nCc: Roland McGrath \u003croland@redhat.com\u003e\nCc: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nCc: James Morris \u003cjmorris@namei.org\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Jeff Dike \u003cjdike@addtoit.com\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: Jan Kara \u003cjack@ucw.cz\u003e\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "161a09e737f0761ca064ee6a907313402f7a54b6", "tree": "80fdf6dc5de73d810ef0ec811299a5ec3c5ce23e", "parents": [ "95b99a670df31ca5271f503f378e5cac3aee8f5e" ], "author": { "name": "Joy Latten", "email": "latten@austin.ibm.com", "time": "Mon Nov 27 13:11:54 2006 -0600" }, "committer": { "name": "David S. Miller", "email": "davem@sunset.davemloft.net", "time": "Wed Dec 06 20:14:22 2006 -0800" }, "message": "audit: Add auditing to ipsec\n\nAn audit message occurs when an ipsec SA\nor ipsec policy is created/deleted.\n\nSigned-off-by: Joy Latten \u003clatten@austin.ibm.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a1f8e7f7fb9d7e2cbcb53170edca7c0ac4680697", "tree": "2d1190c0099291d56a9c986f16bec17df2f6768b", "parents": [ "b07e4ecd4d380ad697c54d729cb653d027077c99" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Oct 19 16:08:53 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Dec 04 02:00:29 2006 -0500" }, "message": "[PATCH] severing skbuff.h -\u003e highmem.h\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "ac9910ce017ff5f86f3a25e969b2c4f5d6ac438f", "tree": "f45d66fa60a02a9f5b32ea95a7d599cb1f175323", "parents": [ "419c58f11fb732cc8bd1335fa43e0decb34e0be3" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Thu Sep 28 14:31:32 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Oct 04 08:31:21 2006 -0400" }, "message": "[PATCH] name_count array overrun\n\nHi,\n\nThis patch removes the rdev logging from the previous patch\n\nThe below patch closes an unbounded use of name_count. This can lead to oopses\nin some new file systems.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "419c58f11fb732cc8bd1335fa43e0decb34e0be3", "tree": "7eb03026bd7e102d235ccc02f81daf1127d93358", "parents": [ "4b8a311bb161a3bd2ab44311f42c526b6dc76270" ], "author": { "name": "Alexander Viro", "email": "aviro@redhat.com", "time": "Fri Sep 29 00:08:50 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Oct 04 08:31:19 2006 -0400" }, "message": "[PATCH] PPID filtering fix\n\nOn Thu, Sep 28, 2006 at 04:03:06PM -0400, Eric Paris wrote:\n\u003e After some looking I did not see a way to get into audit_log_exit\n\u003e without having set the ppid. So I am dropping the set from there and\n\u003e only doing it at the beginning.\n\u003e\n\u003e Please comment/ack/nak as soon as possible.\n\nEhh... That\u0027s one hell of an overhead to be had ;-/ Let\u0027s be lazy.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "eb84a20e9e6b98dcb33023ad22241d79107a08a7", "tree": "4971aef730cc3a1917463afe1dbb381dea664e99", "parents": [ "5f412b24240d92212e50ebbaff2dff20c9e6f3d0" ], "author": { "name": "Alan Cox", "email": "alan@lxorguk.ukuu.org.uk", "time": "Fri Sep 29 02:01:41 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Sep 29 09:18:25 2006 -0700" }, "message": "[PATCH] audit/accounting: tty locking\n\nAdd tty locking around the audit and accounting code.\n\nThe whole current-\u003esignal-\u003e locking is all deeply strange but it\u0027s for\nsomeone else to sort out. Add rather than replace the lock for acct.c\n\nSigned-off-by: Alan Cox \u003calan@redhat.com\u003e\nAcked-by: Arjan van de Ven \u003carjan@linux.intel.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@tv-sign.ru\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1a70cd40cb291c25b67ec0da715a49d76719329d", "tree": "ffb4c6cd3f7ef1b92822ebbda11bd2b035c2bc86", "parents": [ "62bac0185ad3dfef11d9602980445c54d45199c6" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Sep 25 23:31:57 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Sep 26 08:48:52 2006 -0700" }, "message": "[PATCH] selinux: rename selinux_ctxid_to_string\n\nRename selinux_ctxid_to_string to selinux_sid_to_string to be\nconsistent with other interfaces.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "62bac0185ad3dfef11d9602980445c54d45199c6", "tree": "8478673a1dccac5f4e7add4ad802a2bf69b269a4", "parents": [ "89fa30242facca249aead2aac03c4c69764f911c" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Sep 25 23:31:56 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Sep 26 08:48:52 2006 -0700" }, "message": "[PATCH] selinux: eliminate selinux_task_ctxid\n\nEliminate selinux_task_ctxid since it duplicates selinux_task_get_sid.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "55669bfa141b488be865341ed12e188967d11308", "tree": "efeec37a93f46c48937eb849c083da9a42ed3709", "parents": [ "dc104fb3231f11e95b5a0f09ae3ab27a8fd5b2e8" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 31 19:26:40 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Sep 11 13:32:30 2006 -0400" }, "message": "[PATCH] audit: AUDIT_PERM support\n\nadd support for AUDIT_PERM predicate\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3f2792ffbd88dc1cd41d226674cc428914981e98", "tree": "40d176c192eed972df3acd494079d56e6b0e9a34", "parents": [ "5ac3a9c26c1cc4861d9cdd8b293fecbfcdc81afe" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 16 06:43:48 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:59:51 2006 -0400" }, "message": "[PATCH] take filling -\u003epid, etc. out of audit_get_context()\n\nmove that stuff downstream and into the only branch where it\u0027ll be\nused.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5ac3a9c26c1cc4861d9cdd8b293fecbfcdc81afe", "tree": "6ca960fade3253ac358f3614e6a07361fc90d09e", "parents": [ "d51374adf5f2f88155a072d3d801104e3c0c3d7f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Jul 16 06:38:45 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:59:42 2006 -0400" }, "message": "[PATCH] don\u0027t bother with aux entires for dummy context\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d51374adf5f2f88155a072d3d801104e3c0c3d7f", "tree": "2b87e74cdb43fca5635cc25fb5a419cbb686ce00", "parents": [ "471a5c7c839114cc8b55876203aeb2817c33e3c5" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:59:26 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:59:26 2006 -0400" }, "message": "[PATCH] mark context of syscall entered with no rules as dummy\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "471a5c7c839114cc8b55876203aeb2817c33e3c5", "tree": "a034011f4efe66adcdca6e21efc2e05b0c0d3e34", "parents": [ "5422e01ac16df7398b2bad1eccad0ae3be4dee32" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Jul 10 08:29:24 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:55:18 2006 -0400" }, "message": "[PATCH] introduce audit rules counter\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "73d3ec5abad3f1730ac8530899d2c14d92f3ad63", "tree": "c2829a1e36ca155eecc7d4b8648fe9755247bec5", "parents": [ "3e2efce067cec0099f99ae59f28feda99b02b498" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Jul 13 13:16:39 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:50:30 2006 -0400" }, "message": "[PATCH] fix missed create event for directory audit\n\nWhen an object is created via a symlink into an audited directory, audit misses\nthe event due to not having collected the inode data for the directory. Modify\n__audit_inode_child() to copy the parent inode data if a parent wasn\u0027t found in\naudit_names[].\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3e2efce067cec0099f99ae59f28feda99b02b498", "tree": "94577cb6cb7f223319bb89a805b2d6945d42632e", "parents": [ "46f5960fdbf359f0c75989854bbaebc1de7a1eb4" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Jul 13 13:16:02 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Aug 03 10:50:21 2006 -0400" }, "message": "[PATCH] fix faulty inode data collection for open() with O_CREAT\n\nWhen the specified path is an existing file or when it is a symlink, audit\ncollects the wrong inode number, which causes it to miss the open() event.\nAdding a second hook to the open() path fixes this.\n\nAlso add audit_copy_inode() to consolidate some code.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "6e5a2d1d32596850a0ebf7fb3e54c0d69901dabd", "tree": "27718d7df96c9b9f08a2ba333aa36c8e9ebbadfe", "parents": [ "3a6b9f85c641a3b89420b0c8150ed377526a1fe1" ], "author": { "name": "Darrel Goeddel", "email": "dgoeddel@trustedcs.com", "time": "Thu Jun 29 16:57:08 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jul 01 05:44:19 2006 -0400" }, "message": "[PATCH] audit: support for object context filters\n\nThis patch introduces object audit filters based on the elements\nof the SELinux context.\n\nSigned-off-by: Darrel Goeddel \u003cdgoeddel@trustedcs.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n\n kernel/auditfilter.c | 25 +++++++++++++++++++++++++\n kernel/auditsc.c | 40 ++++++++++++++++++++++++++++++++++++++++\n security/selinux/ss/services.c | 18 +++++++++++++++++-\n 3 files changed, 82 insertions(+), 1 deletion(-)\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3a6b9f85c641a3b89420b0c8150ed377526a1fe1", "tree": "e44e64edf0620d3f6da443c57540b09882231459", "parents": [ "5adc8a6adc91c4c85a64c75a70a619fffc924817" ], "author": { "name": "Darrel Goeddel", "email": "dgoeddel@trustedcs.com", "time": "Thu Jun 29 16:56:39 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jul 01 05:44:08 2006 -0400" }, "message": "[PATCH] audit: rename AUDIT_SE_* constants\n\nThis patch renames some audit constant definitions and adds\nadditional definitions used by the following patch. The renaming\navoids ambiguity with respect to the new definitions.\n\nSigned-off-by: Darrel Goeddel \u003cdgoeddel@trustedcs.com\u003e\n\n include/linux/audit.h | 15 ++++++++----\n kernel/auditfilter.c | 50 ++++++++++++++++++++---------------------\n kernel/auditsc.c | 10 ++++----\n security/selinux/ss/services.c | 32 +++++++++++++-------------\n 4 files changed, 56 insertions(+), 51 deletions(-)\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5adc8a6adc91c4c85a64c75a70a619fffc924817", "tree": "ace9af6bbc3cf711f43cfd88e834baeb6989ca3f", "parents": [ "9262e9149f346a5443300f8c451b8e7631e81a42" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Wed Jun 14 18:45:21 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jul 01 05:43:06 2006 -0400" }, "message": "[PATCH] add rule filterkey\n\nAdd support for a rule key, which can be used to tie audit records to audit\nrules. This is useful when a watched file is accessed through a link or\nsymlink, as well as for general audit log analysis.\n\nBecause this patch uses a string key instead of an integer key, there is a bit\nof extra overhead to do the kstrdup() when a rule fires. However, we\u0027re also\nallocating memory for the audit record buffer, so it\u0027s probably not that\nsignificant. I went ahead with a string key because it seems more\nuser-friendly.\n\nNote that the user must ensure that filterkeys are unique. The kernel only\nchecks for duplicate rules.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hpd.com\u003e\n" }, { "commit": "9a66a53f558efc2619a438278d2919b3c9a7f673", "tree": "c3d20628f1d688f6099556995b597ef629970f7f", "parents": [ "4ad98457aa545bc4d03d417da86325507aa586ec" ], "author": { "name": "Jesper Juhl", "email": "jesper.juhl@gmail.com", "time": "Tue Jun 27 02:55:05 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Jun 27 17:32:48 2006 -0700" }, "message": "[PATCH] Remove redundant NULL checks before [kv]free - in kernel/\n\nRemove redundant kfree NULL checks from kernel/\n\nSigned-off-by: Jesper Juhl \u003cjesper.juhl@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1dbe83c3445a1604546620a60888cf26b63f8782", "tree": "c4113aeb6a2beaff433ffddd19121f37e119b444", "parents": [ "283fef59d6e934e8da11631446ea8e2e93fce14c" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@xenotime.net", "time": "Tue Jun 27 02:54:01 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Tue Jun 27 17:32:39 2006 -0700" }, "message": "[PATCH] fix kernel-doc in kernel/ dir\n\nFix kernel-doc parameters in kernel/\n\nWarning(/var/linsrc/linux-2617-g9//kernel/auditsc.c:1376): No description found for parameter \u0027u_abs_timeout\u0027\nWarning(/var/linsrc/linux-2617-g9//kernel/auditsc.c:1420): No description found for parameter \u0027u_msg_prio\u0027\nWarning(/var/linsrc/linux-2617-g9//kernel/auditsc.c:1420): No description found for parameter \u0027u_abs_timeout\u0027\nWarning(/var/linsrc/linux-2617-g9//kernel/acct.c:526): No description found for parameter \u0027pacct\u0027\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "862f5f0133f1c8a179dd93adc03d43f8f7e8bac5", "tree": "51ef137f4a648859c339988413a19ab3567c032e", "parents": [ "d83015b8f62ee3fcd338f6f009051ed57f77a531" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@xenotime.net", "time": "Fri Jun 23 02:05:52 2006 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Jun 23 07:43:07 2006 -0700" }, "message": "[PATCH] Doc: add audit \u0026 acct to DocBook\n\nFix one audit kernel-doc description (one parameter was missing).\nAdd audit*.c interfaces to DocBook.\nAdd BSD accounting interfaces to DocBook.\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "41757106b9ca7867dafb2404d618f947b4786fd7", "tree": "6feff3fade7d842e58d535eef4f397ebfb8ae19e", "parents": [ "9c937dcc71021f2dbf78f904f03d962dd9bcc130" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Mon Jun 12 07:48:28 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:29 2006 -0400" }, "message": "[PATCH] make set_loginuid obey audit_enabled\n\nHi,\n\nI was doing some testing and noticed that when the audit system was disabled,\nI was still getting messages about the loginuid being set. The following patch\nmakes audit_set_loginuid look at in_syscall to determine if it should create\nan audit event. The loginuid will continue to be set as long as there is a context.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "9c937dcc71021f2dbf78f904f03d962dd9bcc130", "tree": "6ab53c1cf1235515307d521cecc4f76afa34e137", "parents": [ "6a2bceec0ea7fdc47aef9a3f2f771c201eaabe5d" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Jun 08 23:19:31 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:28 2006 -0400" }, "message": "[PATCH] log more info for directory entry change events\n\nWhen an audit event involves changes to a directory entry, include\na PATH record for the directory itself. A few other notable changes:\n\n - fixed audit_inode_child() hooks in fsnotify_move()\n - removed unused flags arg from audit_inode()\n - added audit log routines for logging a portion of a string\n\nHere\u0027s some sample output.\n\nbefore patch:\ntype\u003dSYSCALL msg\u003daudit(1149821605.320:26): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbf8d3c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbf8d3c7c items\u003d1 ppid\u003d739 pid\u003d800 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149821605.320:26): cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149821605.320:26): item\u003d0 name\u003d\"foo\" parent\u003d164068 inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nafter patch:\ntype\u003dSYSCALL msg\u003daudit(1149822032.332:24): arch\u003d40000003 syscall\u003d39 success\u003dyes exit\u003d0 a0\u003dbfdd9c7c a1\u003d1ff a2\u003d804e1b8 a3\u003dbfdd9c7c items\u003d2 ppid\u003d714 pid\u003d777 auid\u003d0 uid\u003d0 gid\u003d0 euid\u003d0 suid\u003d0 fsuid\u003d0 egid\u003d0 sgid\u003d0 fsgid\u003d0 tty\u003dttyS0 comm\u003d\"mkdir\" exe\u003d\"/bin/mkdir\" subj\u003droot:system_r:unconfined_t:s0-s0:c0.c255\ntype\u003dCWD msg\u003daudit(1149822032.332:24): cwd\u003d\"/root\"\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d0 name\u003d\"/root\" inode\u003d164068 dev\u003d03:00 mode\u003d040750 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_dir_t:s0\ntype\u003dPATH msg\u003daudit(1149822032.332:24): item\u003d1 name\u003d\"foo\" inode\u003d164010 dev\u003d03:00 mode\u003d040755 ouid\u003d0 ogid\u003d0 rdev\u003d00:00 obj\u003droot:object_r:user_home_t:s0\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "f368c07d7214a7c41dfceb76c8db473b850f0229", "tree": "e3f1e2d1a6ffbe61bf99ece51b906654728db4c9", "parents": [ "20ca73bc792be9625af184cbec36e1372611d1c3" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Fri Apr 07 16:55:56 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:27 2006 -0400" }, "message": "[PATCH] audit: path-based rules\n\nIn this implementation, audit registers inotify watches on the parent\ndirectories of paths specified in audit rules. When audit\u0027s inotify\nevent handler is called, it updates any affected rules based on the\nfilesystem event. If the parent directory is renamed, removed, or its\nfilesystem is unmounted, audit removes all rules referencing that\ninotify watch.\n\nTo keep things simple, this implementation limits location-based\nauditing to the directory entries in an existing directory. Given\na path-based rule for /foo/bar/passwd, the following table applies:\n\n passwd modified -- audit event logged\n passwd replaced -- audit event logged, rules list updated\n bar renamed -- rule removed\n foo renamed -- untracked, meaning that the rule now applies to\n\t\t the new location\n\nAudit users typically want to have many rules referencing filesystem\nobjects, which can significantly impact filtering performance. This\npatch also adds an inode-number-based rule hash to mitigate this\nsituation.\n\nThe patch is relative to the audit git tree:\nhttp://kernel.org/git/?p\u003dlinux/kernel/git/viro/audit-current.git;a\u003dsummary\nand uses the inotify kernel API:\nhttp://lkml.org/lkml/2006/6/1/145\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "20ca73bc792be9625af184cbec36e1372611d1c3", "tree": "98a1232ad3c9baa14676b2b48fab79a3df4a20b0", "parents": [ "8ba8e0fbe6321961f6ba04e2fd7215b37d935c83" ], "author": { "name": "George C. Wilson", "email": "ltcgcw@us.ibm.com", "time": "Wed May 24 16:09:55 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:26 2006 -0400" }, "message": "[PATCH] Audit of POSIX Message Queue Syscalls v.2\n\nThis patch adds audit support to POSIX message queues. It applies cleanly to\nthe lspp.b15 branch of Al Viro\u0027s git tree. There are new auxiliary data\nstructures, and collection and emission routines in kernel/auditsc.c. New hooks\nin ipc/mqueue.c collect arguments from the syscalls.\n\nI tested the patch by building the examples from the POSIX MQ library tarball.\nBuild them -lrt, not against the old MQ library in the tarball. Here\u0027s the URL:\nhttp://www.geocities.com/wronski12/posix_ipc/libmqueue-4.41.tar.gz\nDo auditctl -a exit,always -S for mq_open, mq_timedsend, mq_timedreceive,\nmq_notify, mq_getsetattr. mq_unlink has no new hooks. Please see the\ncorresponding userspace patch to get correct output from auditd for the new\nrecord types.\n\n[fixes folded]\n\nSigned-off-by: George Wilson \u003cltcgcw@us.ibm.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "014149cce19c5acb19014e57a5b739b7f64e6fbf", "tree": "eb92d3e25264e1ff89bffcedaca88c44ff7efae2", "parents": [ "d8945bb51a2bb6623cfa36b9ff63594f46d513aa" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue May 23 01:36:13 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:25 2006 -0400" }, "message": "[PATCH] deprecate AUDIT_POSSBILE\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d8945bb51a2bb6623cfa36b9ff63594f46d513aa", "tree": "b369c9b853e90790a04baa70ee66a2ef9e15fd18", "parents": [ "e0182909297da8d38a5d473ae7bee3d0324632a1" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 18 16:01:30 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:25 2006 -0400" }, "message": "[PATCH] inline more audit helpers\n\npull checks for -\u003eaudit_context into inlined wrappers\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "ac03221a4fdda9bfdabf99bcd129847f20fc1d80", "tree": "9b65ede238b03007bfe5e25f46efca68ec0994e0", "parents": [ "5d136a010de3bc16fe595987feb9ef8868f064c2" ], "author": { "name": "Linda Knippers", "email": "linda.knippers@hp.com", "time": "Tue May 16 22:03:48 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:24 2006 -0400" }, "message": "[PATCH] update of IPC audit record cleanup\n\nThe following patch addresses most of the issues with the IPC_SET_PERM\nrecords as described in:\nhttps://www.redhat.com/archives/linux-audit/2006-May/msg00010.html\nand addresses the comments I received on the record field names.\n\nTo summarize, I made the following changes:\n\n1. Changed sys_msgctl() and semctl_down() so that an IPC_SET_PERM\n record is emitted in the failure case as well as the success case.\n This matches the behavior in sys_shmctl(). I could simplify the\n code in sys_msgctl() and semctl_down() slightly but it would mean\n that in some error cases we could get an IPC_SET_PERM record\n without an IPC record and that seemed odd.\n\n2. No change to the IPC record type, given no feedback on the backward\n compatibility question.\n\n3. Removed the qbytes field from the IPC record. It wasn\u0027t being\n set and when audit_ipc_obj() is called from ipcperms(), the\n information isn\u0027t available. If we want the information in the IPC\n record, more extensive changes will be necessary. Since it only\n applies to message queues and it isn\u0027t really permission related, it\n doesn\u0027t seem worth it.\n\n4. Removed the obj field from the IPC_SET_PERM record. This means that\n the kern_ipc_perm argument is no longer needed.\n\n5. Removed the spaces and renamed the IPC_SET_PERM field names. Replaced iuid and\n igid fields with ouid and ogid in the IPC record.\n\nI tested this with the lspp.22 kernel on an x86_64 box. I believe it\napplies cleanly on the latest kernel.\n\n-- ljk\n\nSigned-off-by: Linda Knippers \u003clinda.knippers@hp.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3c66251e573219a0532a5a07381b2f60a412d9eb", "tree": "b047b25d28ae1abe6bb81daba886e44e0a82094f", "parents": [ "f46038ff7d23ae092d61b366332c05aab8227b48" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat May 06 08:26:27 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:22 2006 -0400" }, "message": "[PATCH] add filtering by ppid\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "f46038ff7d23ae092d61b366332c05aab8227b48", "tree": "b1615e261d90cd6f83065b3d8350a6b2cd7176a2", "parents": [ "e1396065e0489f98b35021b97907ab4edbfb24e1" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat May 06 08:22:52 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:22 2006 -0400" }, "message": "[PATCH] log ppid\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "e1396065e0489f98b35021b97907ab4edbfb24e1", "tree": "a276ea0a2ece9132d435adf1a1f82d0ada1ae938", "parents": [ "473ae30bc7b1dda5c5791c773f95e9424ddfead9" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu May 25 10:19:47 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:21 2006 -0400" }, "message": "[PATCH] collect sid of those who send signals to auditd\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "473ae30bc7b1dda5c5791c773f95e9424ddfead9", "tree": "541f6f20b9131fcfb650ca491e291d3c6b148a1b", "parents": [ "9044e6bca5a4a575d3c068dfccb5651a2d6a13bc" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Apr 26 14:04:08 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Jun 20 05:25:21 2006 -0400" }, "message": "[PATCH] execve argument logging\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "2ad312d2093ae506ae0fa184d8d026b559083087", "tree": "890337ebca18ab31546b84a9831fb9c337e8e272", "parents": [ "073115d6b29c7910feaa08241c6484637f5ca958" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Tue Apr 11 08:50:56 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:10:07 2006 -0400" }, "message": "[PATCH] Audit Filter Performance\n\nWhile testing the watch performance, I noticed that selinux_task_ctxid()\nwas creeping into the results more than it should. Investigation showed\nthat the function call was being called whether it was needed or not. The\nbelow patch fixes this.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "073115d6b29c7910feaa08241c6484637f5ca958", "tree": "5fd32da9f54b3c12b65d3c0142fb9bdf87dc01c3", "parents": [ "ce29b682e228c70cdc91a1b2935c5adb2087bab8" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Sun Apr 02 17:07:33 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:10:04 2006 -0400" }, "message": "[PATCH] Rework of IPC auditing\n\n1) The audit_ipc_perms() function has been split into two different\nfunctions:\n - audit_ipc_obj()\n - audit_ipc_set_perm()\n\nThere\u0027s a key shift here... The audit_ipc_obj() collects the uid, gid,\nmode, and SElinux context label of the current ipc object. This\naudit_ipc_obj() hook is now found in several places. Most notably, it\nis hooked in ipcperms(), which is called in various places around the\nipc code permforming a MAC check. Additionally there are several places\nwhere *checkid() is used to validate that an operation is being\nperformed on a valid object while not necessarily having a nearby\nipcperms() call. In these locations, audit_ipc_obj() is called to\nensure that the information is captured by the audit system.\n\nThe audit_set_new_perm() function is called any time the permissions on\nthe ipc object changes. In this case, the NEW permissions are recorded\n(and note that an audit_ipc_obj() call exists just a few lines before\neach instance).\n\n2) Support for an AUDIT_IPC_SET_PERM audit message type. This allows\nfor separate auxiliary audit records for normal operations on an IPC\nobject and permissions changes. Note that the same struct\naudit_aux_data_ipcctl is used and populated, however there are separate\naudit_log_format statements based on the type of the message. Finally,\nthe AUDIT_IPC block of code in audit_free_aux() was extended to handle\naux messages of this new type. No more mem leaks I hope ;-)\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "ce29b682e228c70cdc91a1b2935c5adb2087bab8", "tree": "39e3e5b345748bec1c2d21962407689cdb1b7dab", "parents": [ "e7c3497013a7e5496ce3d5fd3c73b5cf5af7a56e" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Sat Apr 01 18:29:34 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:10:01 2006 -0400" }, "message": "[PATCH] More user space subject labels\n\nHi,\n\nThe patch below builds upon the patch sent earlier and adds subject label to\nall audit events generated via the netlink interface. It also cleans up a few\nother minor things.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "9c7aa6aa74fa8a5cda36e54cbbe4fffe0214497d", "tree": "1e1489ed5080ea4aff6206bfa904f549de8e56ca", "parents": [ "1b50eed9cac0e8e5e4d3a522d8aa267f7f8f8acb" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri Mar 31 15:22:49 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:56 2006 -0400" }, "message": "[PATCH] change lspp ipc auditing\n\nHi,\n\nThe patch below converts IPC auditing to collect sid\u0027s and convert to context\nstring only if it needs to output an audit record. This patch depends on the\ninode audit change patch already being applied.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "1b50eed9cac0e8e5e4d3a522d8aa267f7f8f8acb", "tree": "c66a1c3be846e34f1aac5db640b7ccb8770e8a80", "parents": [ "3dc7e3153eddfcf7ba8b50628775ba516e5f759f" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Mon Apr 03 14:06:13 2006 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:53 2006 -0400" }, "message": "[PATCH] audit inode patch\n\nPreviously, we were gathering the context instead of the sid. Now in this patch,\nwe gather just the sid and convert to context only if an audit event is being\noutput.\n\nThis patch brings the performance hit from 146% down to 23%\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "3dc7e3153eddfcf7ba8b50628775ba516e5f759f", "tree": "926957e904739fc6c29e5125b7c1635b9f77548c", "parents": [ "376bd9cb357ec945ac893feaeb63af7370a6e70b" ], "author": { "name": "Darrel Goeddel", "email": "dgoeddel@trustedcs.com", "time": "Fri Mar 10 18:14:06 2006 -0600" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:09:36 2006 -0400" }, "message": "[PATCH] support for context based audit filtering, part 2\n\nThis patch provides the ability to filter audit messages based on the\nelements of the process\u0027 SELinux context (user, role, type, mls sensitivity,\nand mls clearance). It uses the new interfaces from selinux to opaquely\nstore information related to the selinux context and to filter based on that\ninformation. It also uses the callback mechanism provided by selinux to\nrefresh the information when a new policy is loaded.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "97e94c453073a2aba4bb5e0825ddc5e923debf11", "tree": "9ed466c5252608302389f59d00c1e9e3eecd7303", "parents": [ "5411be59db80333039386f3b1ccfe5eb9023a916" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Mar 29 20:26:24 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:21 2006 -0400" }, "message": "[PATCH] no need to wank with task_lock() and pinning task down in audit_syscall_exit()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5411be59db80333039386f3b1ccfe5eb9023a916", "tree": "77873af4b7557768c3c48b56e7ae4508be4a70a5", "parents": [ "e495149b173d8e133e1f6f2eb86fd97be7e92010" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Mar 29 20:23:36 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:18 2006 -0400" }, "message": "[PATCH] drop task argument of audit_syscall_{entry,exit}\n\n... it\u0027s always current, and that\u0027s a good thing - allows simpler locking.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "e495149b173d8e133e1f6f2eb86fd97be7e92010", "tree": "387a11cc8a3e272df33bdb0f697ec434b9dfa3fa", "parents": [ "fa84cb935d4ec601528f5e2f0d5d31e7876a5044" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Mar 29 20:17:10 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:16 2006 -0400" }, "message": "[PATCH] drop gfp_mask in audit_log_exit()\n\nnow we can do that - all callers are process-synchronous and do not hold\nany locks.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "fa84cb935d4ec601528f5e2f0d5d31e7876a5044", "tree": "ba0694902a1fec4e32ff15503fc316c24b4a4501", "parents": [ "d6fe3945b42d09a1eca7ad180a1646e585b8594f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Mar 29 20:30:19 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:13 2006 -0400" }, "message": "[PATCH] move call of audit_free() into do_exit()\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "45d9bb0e37668b7c64d1e49e98fbc4733c23b334", "tree": "29b518f84a4e9c4a295dfd92a24b5a5c42c032cc", "parents": [ "e0a515bc6a2188f02916e976f419a8640312e32a" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Mar 29 20:02:55 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon May 01 06:06:07 2006 -0400" }, "message": "[PATCH] deal with deadlocks in audit_free()\n\nDon\u0027t assume that audit_log_exit() et.al. are called for the context of\ncurrent; pass task explictly.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "1b9a3917366028cc451a98dd22e3bcd537d4e5c1", "tree": "d911058720e0a9aeeaf9f407ccdc6fbf4047f47d", "parents": [ "3661f00e2097676847deb01add1a0918044bd816", "71e1c784b24a026a490b3de01541fc5ee14ebc09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Mar 25 09:24:53 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Sat Mar 25 09:24:53 2006 -0800" }, "message": "Merge branch \u0027audit.b3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current\n\n* \u0027audit.b3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: (22 commits)\n [PATCH] fix audit_init failure path\n [PATCH] EXPORT_SYMBOL patch for audit_log, audit_log_start, audit_log_end and audit_format\n [PATCH] sem2mutex: audit_netlink_sem\n [PATCH] simplify audit_free() locking\n [PATCH] Fix audit operators\n [PATCH] promiscuous mode\n [PATCH] Add tty to syscall audit records\n [PATCH] add/remove rule update\n [PATCH] audit string fields interface + consumer\n [PATCH] SE Linux audit events\n [PATCH] Minor cosmetic cleanups to the code moved into auditfilter.c\n [PATCH] Fix audit record filtering with !CONFIG_AUDITSYSCALL\n [PATCH] Fix IA64 success/failure indication in syscall auditing.\n [PATCH] Miscellaneous bug and warning fixes\n [PATCH] Capture selinux subject/object context information.\n [PATCH] Exclude messages by message type\n [PATCH] Collect more inode information during syscall processing.\n [PATCH] Pass dentry, not just name, in fsnotify creation hooks.\n [PATCH] Define new range of userspace messages.\n [PATCH] Filter rule comparators\n ...\n\nFixed trivial conflict in security/selinux/hooks.c\n" }, { "commit": "4023e020807ea249ae83f0d1d851b4c7cf0afd8a", "tree": "3bc91756c9429bd89c2ebb47108ed772dd29c4cf", "parents": [ "d9d9ec6e2c45b22282cd36cf92fcb23d504350a8" ], "author": { "name": "Ingo Molnar", "email": "mingo@elte.hu", "time": "Tue Mar 07 23:51:39 2006 -0800" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:55 2006 -0500" }, "message": "[PATCH] simplify audit_free() locking\n\nSimplify audit_free()\u0027s locking: no need to lock a task that we are tearing\ndown. [the extra locking also caused false positives in the lock\nvalidator]\n\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "a6c043a887a9db32a545539426ddfc8cc2c28f8f", "tree": "61269890edbf13a5bb2ae41eb4aba9353a2382b8", "parents": [ "5d3301088f7e412992d9e61cc3604cbdff3090ff" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Sun Jan 01 14:07:00 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:55 2006 -0500" }, "message": "[PATCH] Add tty to syscall audit records\n\nHi,\n\n\u003eFrom the RBAC specs:\n\nFAU_SAR.1.1 The TSF shall provide the set of authorized\nRBAC administrators with the capability to read the following\naudit information from the audit records:\n\n\u003csnip\u003e\n(e) The User Session Identifier or Terminal Type\n\nA patch adding the tty for all syscalls is included in this email.\nPlease apply.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "93315ed6dd12dacfc941f9eb8ca0293aadf99793", "tree": "4fc070c92a1de21d3befe4ce48c733c65d044bb3", "parents": [ "af601e4623d0303bfafa54ec728b7ae8493a8e1b" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Tue Feb 07 12:05:27 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:54 2006 -0500" }, "message": "[PATCH] audit string fields interface + consumer\n\nUpdated patch to dynamically allocate audit rule fields in kernel\u0027s\ninternal representation. Added unlikely() calls for testing memory\nallocation result.\n\nAmy Griffis wrote: [Wed Jan 11 2006, 02:02:31PM EST]\n\u003e Modify audit\u0027s kernel-userspace interface to allow the specification\n\u003e of string fields in audit rules.\n\u003e\n\u003e Signed-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n(cherry picked from 5ffc4a863f92351b720fe3e9c5cd647accff9e03 commit)\n" }, { "commit": "fe7752bab26a9ac0651b695ad4f55659761f68f7", "tree": "b2e516a52232c978fc824b226418d8a28460b8a8", "parents": [ "ee436dc46a762f430e37952d375a23d87735f73f" ], "author": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Thu Dec 15 18:33:52 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:54 2006 -0500" }, "message": "[PATCH] Fix audit record filtering with !CONFIG_AUDITSYSCALL\n\nThis fixes the per-user and per-message-type filtering when syscall\nauditing isn\u0027t enabled.\n\n[AV: folded followup fix from the same author]\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "7306a0b9b3e2056a616c84841288ca2431a05627", "tree": "d3f61ef43c7079790d6b8ef9bf307689a7d9ea16", "parents": [ "8c8570fb8feef2bc166bee75a85748b25cda22d9" ], "author": { "name": "Dustin Kirkland", "email": "dustin.kirkland@us.ibm.com", "time": "Wed Nov 16 15:53:13 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:54 2006 -0500" }, "message": "[PATCH] Miscellaneous bug and warning fixes\n\nThis patch fixes a couple of bugs revealed in new features recently\nadded to -mm1:\n* fixes warnings due to inconsistent use of const struct inode *inode\n* fixes bug that prevent a kernel from booting with audit on, and SELinux off\n due to a missing function in security/dummy.c\n* fixes a bug that throws spurious audit_panic() messages due to a missing\n return just before an error_path label\n* some reasonable house cleaning in audit_ipc_context(),\n audit_inode_context(), and audit_log_task_context()\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "8c8570fb8feef2bc166bee75a85748b25cda22d9", "tree": "ed783d405ea9d5f3d3ccc57fb56c7b7cb2cdfb82", "parents": [ "c8edc80c8b8c397c53f4f659a05b9ea6208029bf" ], "author": { "name": "Dustin Kirkland", "email": "dustin.kirkland@us.ibm.com", "time": "Thu Nov 03 17:15:16 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:54 2006 -0500" }, "message": "[PATCH] Capture selinux subject/object context information.\n\nThis patch extends existing audit records with subject/object context\ninformation. Audit records associated with filesystem inodes, ipc, and\ntasks now contain SELinux label information in the field \"subj\" if the\nitem is performing the action, or in \"obj\" if the item is the receiver\nof an action.\n\nThese labels are collected via hooks in SELinux and appended to the\nappropriate record in the audit code.\n\nThis additional information is required for Common Criteria Labeled\nSecurity Protection Profile (LSPP).\n\n[AV: fixed kmalloc flags use]\n[folded leak fixes]\n[folded cleanup from akpm (kfree(NULL)]\n[folded audit_inode_context() leak fix]\n[folded akpm\u0027s fix for audit_ipc_perm() definition in case of !CONFIG_AUDIT]\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "c8edc80c8b8c397c53f4f659a05b9ea6208029bf", "tree": "0b09c0ff9ea28038b711d7368100302a1cc69b6d", "parents": [ "73241ccca0f7786933f1d31b3d86f2456549953a" ], "author": { "name": "Dustin Kirkland", "email": "dustin.kirkland@us.ibm.com", "time": "Thu Nov 03 16:12:36 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:54 2006 -0500" }, "message": "[PATCH] Exclude messages by message type\n\n - Add a new, 5th filter called \"exclude\".\n - And add a new field AUDIT_MSGTYPE.\n - Define a new function audit_filter_exclude() that takes a message type\n as input and examines all rules in the filter. It returns \u00271\u0027 if the\n message is to be excluded, and \u00270\u0027 otherwise.\n - Call the audit_filter_exclude() function near the top of\n audit_log_start() just after asserting audit_initialized. If the\n message type is not to be audited, return NULL very early, before\n doing a lot of work.\n[combined with followup fix for bug in original patch, Nov 4, same author]\n[combined with later renaming AUDIT_FILTER_EXCLUDE-\u003eAUDIT_FILTER_TYPE\nand audit_filter_exclude() -\u003e audit_filter_type()]\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "73241ccca0f7786933f1d31b3d86f2456549953a", "tree": "daa7efabfb7aa2f511a467606786820949e8763e", "parents": [ "f38aa94224c5517a40ba56d453779f70d3229803" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Nov 03 16:00:25 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:53 2006 -0500" }, "message": "[PATCH] Collect more inode information during syscall processing.\n\nThis patch augments the collection of inode info during syscall\nprocessing. It represents part of the functionality that was provided\nby the auditfs patch included in RHEL4.\n\nSpecifically, it:\n\n- Collects information for target inodes created or removed during\n syscalls. Previous code only collects information for the target\n inode\u0027s parent.\n\n- Adds the audit_inode() hook to syscalls that operate on a file\n descriptor (e.g. fchown), enabling audit to do inode filtering for\n these calls.\n\n- Modifies filtering code to check audit context for either an inode #\n or a parent inode # matching a given rule.\n\n- Modifies logging to provide inode # for both parent and child.\n\n- Protect debug info from NULL audit_names.name.\n\n[AV: folded a later typo fix from the same author]\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "f38aa94224c5517a40ba56d453779f70d3229803", "tree": "30d0f7390cb2f1cf33a55080cb6c0676727af1fa", "parents": [ "90d526c074ae5db484388da56c399acf892b6c17" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Thu Nov 03 15:57:06 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:53 2006 -0500" }, "message": "[PATCH] Pass dentry, not just name, in fsnotify creation hooks.\n\nThe audit hooks (to be added shortly) will want to see dentry-\u003ed_inode\ntoo, not just the name.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "b63862f46547487388e582e8ac9083830d34f058", "tree": "5aa0173c02535fdd9dfe302e9c8a8a225091ed56", "parents": [ "b0dd25a8263dde3c30b0d7d72a8bd92d7ba0e3f5" ], "author": { "name": "Dustin Kirkland", "email": "dustin.kirkland@us.ibm.com", "time": "Thu Nov 03 15:41:46 2005 +0000" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:53 2006 -0500" }, "message": "[PATCH] Filter rule comparators\n\nCurrently, audit only supports the \"\u003d\" and \"!\u003d\" operators in the -F\nfilter rules.\n\nThis patch reworks the support for \"\u003d\" and \"!\u003d\", and adds support\nfor \"\u003e\", \"\u003e\u003d\", \"\u003c\", and \"\u003c\u003d\".\n\nThis turned out to be a pretty clean, and simply process. I ended up\nusing the high order bits of the \"field\", as suggested by Steve and Amy.\nThis allowed for no changes whatsoever to the netlink communications.\nSee the documentation within the patch in the include/linux/audit.h\narea, where there is a table that explains the reasoning of the bitmask\nassignments clearly.\n\nThe patch adds a new function, audit_comparator(left, op, right).\nThis function will perform the specified comparison (op, which defaults\nto \"\u003d\u003d\" for backward compatibility) between two values (left and right).\nIf the negate bit is on, it will negate whatever that result was. This\nvalue is returned.\n\nSigned-off-by: Dustin Kirkland \u003cdustin.kirkland@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "b0dd25a8263dde3c30b0d7d72a8bd92d7ba0e3f5", "tree": "8eadfe525920c8256d755b084035a513e3dcab47", "parents": [ "7e7f8a036b8e2b2a300df016da5e7128c8a9192e" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@xenotime.net", "time": "Tue Sep 13 12:47:11 2005 -0700" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:53 2006 -0500" }, "message": "[PATCH] AUDIT: kerneldoc for kernel/audit*.c\n\n- add kerneldoc for non-static functions;\n- don\u0027t init static data to 0;\n- limit lines to \u003c 80 columns;\n- fix long-format style;\n- delete whitespace at end of some lines;\n\n(chrisw: resend and update to current audit-2.6 tree)\n\nSigned-off-by: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "7e7f8a036b8e2b2a300df016da5e7128c8a9192e", "tree": "b3681a073f4ef97a91f53d4b23d0c5aeccbe4993", "parents": [ "7705a8792b0fc82fd7d4dd923724606bbfd9fb20" ], "author": { "name": "Jason Baron", "email": "jbaron@redhat.com", "time": "Tue Jan 31 16:56:28 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Mar 20 14:08:53 2006 -0500" }, "message": "[PATCH] make vm86 call audit_syscall_exit\n\nhi,\n\nThe motivation behind the patch below was to address messages in\n/var/log/messages such as:\n\nJan 31 10:54:15 mets kernel: audit(:0): major\u003d252 name_count\u003d0: freeing\nmultiple contexts (1)\nJan 31 10:54:15 mets kernel: audit(:0): major\u003d113 name_count\u003d0: freeing\nmultiple contexts (2)\n\nI can reproduce by running \u0027get-edid\u0027 from:\nhttp://john.fremlin.de/programs/linux/read-edid/.\n\nThese messages come about in the log b/c the vm86 calls do not exit via\nthe normal system call exit paths and thus do not call\n\u0027audit_syscall_exit\u0027. The next system call will then free the context for\nitself and for the vm86 context, thus generating the above messages. This\npatch addresses the issue by simply adding a call to \u0027audit_syscall_exit\u0027\nfrom the vm86 code.\n\nBesides fixing the above error messages the patch also now allows vm86\nsystem calls to become auditable. This is useful since strace does not\nappear to properly record the return values from sys_vm86.\n\nI think this patch is also a step in the right direction in terms of\ncleaning up some core auditing code. If we can correct any other paths\nthat do not properly call the audit exit and entries points, then we can\nalso eliminate the notion of context chaining.\n\nI\u0027ve tested this patch by verifying that the log messages no longer\nappear, and that the audit records for sys_vm86 appear to be correct.\nAlso, \u0027read_edid\u0027 produces itentical output.\n\nthanks,\n\n-Jason\n\nSigned-off-by: Jason Baron \u003cjbaron@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "a00428f5b149e36b8225b2a0812742a6dfb07b8c", "tree": "a78869cd67cf78a0eb091fb0ea5d397734bd6738", "parents": [ "774fee58c465ea1c7e9775e347ec307bcf2deeb3", "fb5c594c2acc441f0d2d8f457484a0e0e9285db3" ], "author": { "name": "Paul Mackerras", "email": "paulus@samba.org", "time": "Fri Feb 24 14:05:47 2006 +1100" }, "committer": { "name": "Paul Mackerras", "email": "paulus@samba.org", "time": "Fri Feb 24 14:05:47 2006 +1100" }, "message": "Merge ../powerpc-merge\n" }, { "commit": "ef20c8c197df9b8d5bd4af0679123826da028861", "tree": "764632d00ca11f241013b1e203d1b9a5c9e30acb", "parents": [ "bd71c2b17468a2531fb4c81ec1d73520845e97e1" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Feb 18 15:41:50 2006 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Feb 18 15:41:50 2006 -0500" }, "message": "[PATCH] GFP_KERNEL allocations in atomic (auditsc)\n\naudit_log_exit() is called from atomic contexts and gets explicit\ngfp_mask argument; it should use it for all allocations rather\nthan doing some with gfp_mask and some with GFP_KERNEL.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "2ef9481e666b4654159ac9f847e6963809e3c470", "tree": "62abb35633702dcc585df1e2ee093aaf0dc6bb07", "parents": [ "75288c78c69020a574d93770c3a941b785f3d93d" ], "author": { "name": "Jon Mason", "email": "jdmason@us.ibm.com", "time": "Mon Jan 23 10:58:20 2006 -0600" }, "committer": { "name": "Paul Mackerras", "email": "paulus@samba.org", "time": "Fri Feb 10 16:53:51 2006 +1100" }, "message": "[PATCH] powerpc: trivial: modify comments to refer to new location of files\n\nThis patch removes all self references and fixes references to files\nin the now defunct arch/ppc64 tree. I think this accomplises\neverything wanted, though there might be a few references I missed.\n\nSigned-off-by: Jon Mason \u003cjdmason@us.ibm.com\u003e\nSigned-off-by: Paul Mackerras \u003cpaulus@samba.org\u003e\n" }, { "commit": "715b49ef2de6fcead0776d9349071670282faf65", "tree": "d09b77c804aba3b191dc0ceb294387cf730ede4b", "parents": [ "3213e913b0d6baeb28aa1affbdd4bfa7efedc35f" ], "author": { "name": "Alan Cox", "email": "alan@lxorguk.ukuu.org.uk", "time": "Wed Jan 18 17:44:07 2006 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Wed Jan 18 19:20:30 2006 -0800" }, "message": "[PATCH] EDAC: atomic scrub operations\n\nEDAC requires a way to scrub memory if an ECC error is found and the chipset\ndoes not do the work automatically. That means rewriting memory locations\natomically with respect to all CPUs _and_ bus masters. That means we can\u0027t\nuse atomic_add(foo, 0) as it gets optimised for non-SMP\n\nThis adds a function to include/asm-foo/atomic.h for the platforms currently\nsupported which implements a scrub of a mapped block.\n\nIt also adjusts a few other files include order where atomic.h is included\nbefore types.h as this now causes an error as atomic_scrub uses u32.\n\nSigned-off-by: Alan Cox \u003calan@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "9796fdd829da626374458e8706daedcc0e432ddd", "tree": "a0b4af7f45267cdcdfb677c2167906c6ef981b76", "parents": [ "55016f10e31bb15b85d8c500f979dfdceb37d548" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Oct 21 03:22:03 2005 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@g5.osdl.org", "time": "Fri Oct 28 08:16:49 2005 -0700" }, "message": "[PATCH] gfp_t: kernel/*\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "b01f2cc1c37ac3d5ca313c90370a586dffe5aca9", "tree": "04fb64e730b6e36293c30cade3606cf53c8c8e20", "parents": [ "17888225c2f392bfdbac6c7f0713cbd9a4d02b05" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat Aug 27 10:25:43 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat Aug 27 10:25:43 2005 +0100" }, "message": "[AUDIT] Allow filtering on system call success _or_ failure\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "3c789a19054034847afe80af2f23ebb0eebfbad6", "tree": "cc983b5fd132c329e16d61d408d8a26ca048cf6b", "parents": [ "c3896495942392f1a792da1cafba7a573cbf6fc2" ], "author": { "name": "Amy Griffis", "email": "amy.griffis@hp.com", "time": "Wed Aug 17 16:05:35 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Aug 17 16:05:35 2005 +0100" }, "message": "AUDIT: Prevent duplicate syscall rules\n\nThe following patch against audit.81 prevents duplicate syscall rules in\na given filter list by walking the list on each rule add.\n\nI also removed the unused struct audit_entry in audit.c and made the\nstatic inlines in auditsc.c consistent.\n\nSigned-off-by: Amy Griffis \u003camy.griffis@hp.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "c3896495942392f1a792da1cafba7a573cbf6fc2", "tree": "1a042845b7a57118b1eb993b6dacdfe9cca7d440", "parents": [ "413a1c7520ad6207c9122a749983c500f29e3e32" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Aug 17 14:49:57 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Aug 17 14:49:57 2005 +0100" }, "message": "AUDIT: Speed up audit_filter_syscall() for the non-auditable case.\n\nIt was showing up fairly high on profiles even when no rules were set.\nMake sure the common path stays as fast as possible.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "413a1c7520ad6207c9122a749983c500f29e3e32", "tree": "81155d0224d35cace00c1fe50a146e30a58e68d4", "parents": [ "327b6b08d6ab3bf5488120ba02ed2fe06b09efe6" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Aug 17 14:45:55 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Aug 17 14:45:55 2005 +0100" }, "message": "AUDIT: Fix task refcount leak in audit_filter_syscall()\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "ce625a801664d8ed7344117bbb57510e4e0e872c", "tree": "50e6760a0b1b506b234700afddc7296b28918650", "parents": [ "d5b454f2c40c9efd0cc113bc3220ebcb66b7c022" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jul 18 14:24:46 2005 -0400" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jul 18 14:24:46 2005 -0400" }, "message": "AUDIT: Reduce contention in audit_serial()\n... by generating serial numbers only if an audit context is actually\n_used_, rather than doing so at syscall entry even when the context\nisn\u0027t necessarily marked auditable.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "351bb722590b2329ac5e72c4b824b8b6ce6e3082", "tree": "3c67b739953061af5762d31de9a922e5c6237007", "parents": [ "f55619642e863990d5a46cf2c2c840170d22a9f9" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu Jul 14 14:40:06 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu Jul 14 14:40:06 2005 +0100" }, "message": "AUDIT: Fix compile error in audit_filter_syscall\n\nWe didn\u0027t rename it to audit_tgid after all. Except once... Doh.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "f55619642e863990d5a46cf2c2c840170d22a9f9", "tree": "faf2447562a26c4620d254fd1b46f3ae7e6fc678", "parents": [ "582edda586120004d0fb67113115fa442a0a1571" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jul 13 22:47:07 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jul 13 22:47:07 2005 +0100" }, "message": "AUDIT: Avoid scheduling in idle thread\nWhen we flush a pending syscall audit record due to audit_free(), we\nmight be doing that in the context of the idle thread. So use GFP_ATOMIC\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "582edda586120004d0fb67113115fa442a0a1571", "tree": "44524dc0424f455c06a58ab4223f21d2efc45948", "parents": [ "6c8c8ba5d7e31b37d0184c388183a6039a672417" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jul 13 22:39:34 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jul 13 22:39:34 2005 +0100" }, "message": "AUDIT: Exempt the whole auditd thread-group from auditing\nand not just the one thread.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "21af6c4f2aa5f63138871b4ddd77d7ebf2588c9d", "tree": "5f10080f93bc6460ef87886a906498cec332b1a6", "parents": [ "ac4cec443a80bfde829516e7a7db10f7325aa528" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat Jul 02 14:10:46 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat Jul 02 14:10:46 2005 +0100" }, "message": "AUDIT: Really don\u0027t audit auditd.\n\nThe pid in the audit context isn\u0027t always set up. Use tsk-\u003epid when \nchecking whether it\u0027s auditd in audit_filter_syscall(), instead of \nctx-\u003epid. Remove a band-aid which did the same elsewhere.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "5bb289b5a0becb53ac3e1d60815ff8b779296b73", "tree": "0db75422d66eec857e0c05cd4cf4d014e7c0e264", "parents": [ "993e2d4106e94dae6e8cfbeb32073bd12cdee203" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Jun 24 14:14:05 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Jun 24 14:14:05 2005 +0100" }, "message": "AUDIT: Clean up user message filtering\n\nDon\u0027t look up the task by its pid and then use the syscall filtering\nhelper. Just implement our own filter helper which operates solely on\nthe information in the netlink_skb_parms. \n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "993e2d4106e94dae6e8cfbeb32073bd12cdee203", "tree": "fdb89f0a1f773795b092e0ddbb902d071f5f9c5c", "parents": [ "9e94e66a5bc739ab525ec0a26ba75300aaf154f3" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Jun 24 08:21:49 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Jun 24 08:21:49 2005 +0100" }, "message": "AUDIT: Return correct result from audit_filter_rules()\n\nWhen the task refcounting was added to audit_filter_rules() it became\nmore of a problem that this function was violating the \u0027only one \nreturn from each function\u0027 rule. In fixing it to use a variable to store \n\u0027ret\u0027 I stupidly neglected to actually change the \u0027return 1;\u0027 at the \nend. This makes it not work very well.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "9e94e66a5bc739ab525ec0a26ba75300aaf154f3", "tree": "b75da428ad7067959b24a0e2e6b64094750025b9", "parents": [ "9470178e620fe8f512928eed34994572c1c44be4" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu Jun 23 18:33:54 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu Jun 23 18:33:54 2005 +0100" }, "message": "AUDIT: No really, we don\u0027t want to audit auditd.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "9ad9ad385be27fcc7c16d290d972c6173e780a61", "tree": "bbca700c2d88ba421a6c9c348de367eaf4de0e2c", "parents": [ "177bbc733a1d9c935bc3d6efd776a6699b29b1ca" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jun 22 15:04:33 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jun 22 15:04:33 2005 +0100" }, "message": "AUDIT: Wait for backlog to clear when generating messages.\n\nAdd a gfp_mask to audit_log_start() and audit_log(), to reduce the\namount of GFP_ATOMIC allocation -- most of it doesn\u0027t need to be \nGFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to\n60 seconds for the auditd backlog to clear instead of immediately \nabandoning the message. \n\nThe timeout should probably be made configurable, but for now it\u0027ll \nsuffice that it only happens if auditd is actually running.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "4a4cd633b575609b741a1de7837223a2d9e1c34c", "tree": "f4c3a6beb6a587598193053240f3e3f82885f1e3", "parents": [ "f6a789d19858a951e7ff9e297a44b377c21b6c33" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jun 22 14:56:47 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed Jun 22 14:56:47 2005 +0100" }, "message": "AUDIT: Optimise the audit-disabled case for discarding user messages\n\nAlso exempt USER_AVC message from being discarded to preserve \nexisting behaviour for SE Linux.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "f6a789d19858a951e7ff9e297a44b377c21b6c33", "tree": "5e54f1460bc048706ad6df8c5cb5bf748f067f13", "parents": [ "ae7b961b1c943367dfe179411f120d7bf8eaba89" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Tue Jun 21 16:22:01 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Tue Jun 21 16:22:01 2005 +0100" }, "message": "AUDIT: Spawn kernel thread to list filter rules.\n\nIf we have enough rules to fill the netlink buffer space, it\u0027ll \ndeadlock because auditctl isn\u0027t ever actually going to read from the \nsocket until we return, and we aren\u0027t going to return until it \nreads... so we spawn a kernel thread to spew out the list and then\nexit.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "ae7b961b1c943367dfe179411f120d7bf8eaba89", "tree": "d40171c26b22295e45ad7b67923442bfb513752a", "parents": [ "f7056d64ae101d910f965a2e39831f635ef7891b" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jun 20 16:11:05 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jun 20 16:11:05 2005 +0100" }, "message": "AUDIT: Report lookup flags with path/inode records.\n\nWhen LOOKUP_PARENT is used, the inode which results is not the inode\nfound at the pathname. Report the flags so that this doesn\u0027t generate\nmisleading audit records.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "f7056d64ae101d910f965a2e39831f635ef7891b", "tree": "854070383dca5ba3e865c663485a5d97adbbcf54", "parents": [ "d6e0e1585a1a9a15e48ec47206a809828afe4450" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jun 20 16:07:33 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon Jun 20 16:07:33 2005 +0100" }, "message": "AUDIT: Really exempt auditd from having its actions audited.\n\nWe were only avoiding it on syscall exit before; now stop _everything_.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "0f45aa18e65cf3d768082d7d86054a0d2a20bb18", "tree": "6e94dfcd813061f5a710b5621e1b2f5a01a95533", "parents": [ "0107b3cf3225aed6ddde4fa8dbcd4ed643b34f4d" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sun Jun 19 19:35:50 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sun Jun 19 19:35:50 2005 +0100" }, "message": "AUDIT: Allow filtering of user messages\n\nTurn the field from a bitmask to an enumeration and add a list to allow \nfiltering of messages generated by userspace. We also define a list for \nfile system watches in anticipation of that feature.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "8f37d47c9bf74cb48692691086b482e315d07f40", "tree": "b7d35bbd8e78d124455f3abbc9c50134bc9cee0a", "parents": [ "7551ced334ce6eb2a7a765309871e619f645add1" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 27 12:17:28 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 27 12:17:28 2005 +0100" }, "message": "AUDIT: Record working directory when syscall arguments are pathnames\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "7551ced334ce6eb2a7a765309871e619f645add1", "tree": "b34088792efdf335e6a2c02a9c97768da84a695a", "parents": [ "37ca5389b863e5ffba6fb7c22331bf57dbf7764a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 26 12:04:57 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 26 12:04:57 2005 +0100" }, "message": "AUDIT: Defer freeing aux items until audit_free_context()\n\nWhile they were all just simple blobs it made sense to just free them\nas we walked through and logged them. Now that there are pointers to\nother objects which need refcounting, we might as well revert to\n_only_ logging them in audit_log_exit(), and put the code to free them\nproperly in only one place -- in audit_free_aux().\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n----------------------------------------------------------\n" }, { "commit": "99e45eeac867d51ff3395dcf3d7aedf5ac2812c8", "tree": "6cad4f59214ed4563ddc189bc98f05d1e2b1a5cc", "parents": [ "bccf6ae083318ea08094d6ab185fdf7c49906b3a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:57:41 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:57:41 2005 +0100" }, "message": "AUDIT: Escape comm when logging task info\n\nIt comes from the user; it needs to be escaped.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "bccf6ae083318ea08094d6ab185fdf7c49906b3a", "tree": "0dc4fabe9004aa666e646c69e976fda989c08565", "parents": [ "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:35:28 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:35:28 2005 +0100" }, "message": "AUDIT: Unify auid reporting, put arch before syscall number\n\nThese changes make processing of audit logs easier. Based on a patch\nfrom Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a", "tree": "72a2068a1008a66db09ad6eebfdeb490f1a33308", "parents": [ "7b5d781ce1f19fb7382d3d3fb7af48e429bed12d" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 21:08:09 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 21:08:09 2005 +0100" }, "message": "AUDIT: Assign serial number to non-syscall messages\n\nMove audit_serial() into audit.c and use it to generate serial numbers \non messages even when there is no audit context from syscall auditing. \nThis allows us to disambiguate audit records when more than one is \ngenerated in the same millisecond.\n\nBased on a patch by Steve Grubb after he observed the problem.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n\n" }, { "commit": "326e9c8ba6a149f47e020719b23b24a14ba740d6", "tree": "279ace274d6a5e7c696c95f397bfbf5d5d5c347a", "parents": [ "05474106a41f44d16d649bc8c7687fc24ce4370a" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Sat May 21 00:22:31 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 00:22:31 2005 +0100" }, "message": "AUDIT: Fix inconsistent use of loginuid vs. auid, signed vs. unsigned \n\nThe attached patch changes all occurrences of loginuid to auid. It also \nchanges everything to %u that is an unsigned type.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" } ], "next": "011161051bbc25f7f8b7df059dbd934c534443f0" }