)]}' { "log": [ { "commit": "8f37d47c9bf74cb48692691086b482e315d07f40", "tree": "b7d35bbd8e78d124455f3abbc9c50134bc9cee0a", "parents": [ "7551ced334ce6eb2a7a765309871e619f645add1" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 27 12:17:28 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 27 12:17:28 2005 +0100" }, "message": "AUDIT: Record working directory when syscall arguments are pathnames\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "7551ced334ce6eb2a7a765309871e619f645add1", "tree": "b34088792efdf335e6a2c02a9c97768da84a695a", "parents": [ "37ca5389b863e5ffba6fb7c22331bf57dbf7764a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 26 12:04:57 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 26 12:04:57 2005 +0100" }, "message": "AUDIT: Defer freeing aux items until audit_free_context()\n\nWhile they were all just simple blobs it made sense to just free them\nas we walked through and logged them. Now that there are pointers to\nother objects which need refcounting, we might as well revert to\n_only_ logging them in audit_log_exit(), and put the code to free them\nproperly in only one place -- in audit_free_aux().\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n----------------------------------------------------------\n" }, { "commit": "99e45eeac867d51ff3395dcf3d7aedf5ac2812c8", "tree": "6cad4f59214ed4563ddc189bc98f05d1e2b1a5cc", "parents": [ "bccf6ae083318ea08094d6ab185fdf7c49906b3a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:57:41 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:57:41 2005 +0100" }, "message": "AUDIT: Escape comm when logging task info\n\nIt comes from the user; it needs to be escaped.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "bccf6ae083318ea08094d6ab185fdf7c49906b3a", "tree": "0dc4fabe9004aa666e646c69e976fda989c08565", "parents": [ "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:35:28 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Mon May 23 21:35:28 2005 +0100" }, "message": "AUDIT: Unify auid reporting, put arch before syscall number\n\nThese changes make processing of audit logs easier. Based on a patch\nfrom Steve Grubb \u003csgrubb@redhat.com\u003e\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "bfb4496e7239c9132d732a65cdcf3d6a7431ad1a", "tree": "72a2068a1008a66db09ad6eebfdeb490f1a33308", "parents": [ "7b5d781ce1f19fb7382d3d3fb7af48e429bed12d" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 21:08:09 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 21:08:09 2005 +0100" }, "message": "AUDIT: Assign serial number to non-syscall messages\n\nMove audit_serial() into audit.c and use it to generate serial numbers \non messages even when there is no audit context from syscall auditing. \nThis allows us to disambiguate audit records when more than one is \ngenerated in the same millisecond.\n\nBased on a patch by Steve Grubb after he observed the problem.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n\n" }, { "commit": "326e9c8ba6a149f47e020719b23b24a14ba740d6", "tree": "279ace274d6a5e7c696c95f397bfbf5d5d5c347a", "parents": [ "05474106a41f44d16d649bc8c7687fc24ce4370a" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Sat May 21 00:22:31 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 00:22:31 2005 +0100" }, "message": "AUDIT: Fix inconsistent use of loginuid vs. auid, signed vs. unsigned \n\nThe attached patch changes all occurrences of loginuid to auid. It also \nchanges everything to %u that is an unsigned type.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "011161051bbc25f7f8b7df059dbd934c534443f0", "tree": "f1ca3727e4130cacad86dfdae65e7533fcb67784", "parents": [ "fb19b4c6aa024837a0071f07baa07dbf49d07151" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Sat May 21 00:15:52 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Sat May 21 00:15:52 2005 +0100" }, "message": "AUDIT: Avoid sleeping function in SElinux AVC audit.\n\nThis patch changes the SELinux AVC to defer logging of paths to the audit\nframework upon syscall exit, by saving a reference to the (dentry,vfsmount)\npair in an auxiliary audit item on the current audit context for processing\nby audit_log_exit.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "7ca0026495dbb644b4e32ede76be44072cb2bc7a", "tree": "12c832161ebb98a7e7aec7edd8942e20809fafec", "parents": [ "cd77b8212d5473b800ac865364981d334ff564ea" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 19 11:23:13 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Thu May 19 11:23:13 2005 +0100" }, "message": "AUDIT: Quis Custodiet Ipsos Custodes?\n\nNobody does. Really, it gets very silly if auditd is recording its\nown actions.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "3ec3b2fba526ead2fa3f3d7c91924f39a0733749", "tree": "12b9b3de4e0d5bb3c977ea3ef534ba4f7e556cb9", "parents": [ "69887ac1dcb79dfc773dabac2dd081fa6d6e2573" ], "author": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Tue May 17 12:08:48 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Tue May 17 12:08:48 2005 +0100" }, "message": "AUDIT: Capture sys_socketcall arguments and sockaddrs \n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "23f32d18aa589e228c5a9e12e0d0c67c9b5bcdce", "tree": "fa8e1156035b871d446cdf9706898b761d6455e0", "parents": [ "c04049939f88b29e235d2da217bce6e8ead44f32" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri May 13 18:35:15 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 13 18:35:15 2005 +0100" }, "message": "AUDIT: Fix some spelling errors\n\nI\u0027m going through the kernel code and have a patch that corrects \nseveral spelling errors in comments.\n\nFrom: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "c04049939f88b29e235d2da217bce6e8ead44f32", "tree": "9bf3ab72b9939c529e7c96f8768bc8b7e1d768c9", "parents": [ "9ea74f0655412d0fbd12bf9adb6c14c8fe707a42" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri May 13 18:17:42 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 13 18:17:42 2005 +0100" }, "message": "AUDIT: Add message types to audit records\n\nThis patch adds more messages types to the audit subsystem so that audit \nanalysis is quicker, intuitive, and more useful.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\n---\nI forgot one type in the big patch. I need to add one for user space \noriginating SE Linux avc messages. This is used by dbus and nscd.\n\n-Steve\n---\nUpdated to 2.6.12-rc4-mm1.\n-dwmw2\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "c1b773d87eadc3972d697444127e89a7291769a2", "tree": "edfce2e842c3b6be70f3b90584507aab9fb3de8f", "parents": [ "197c69c6afd2deb7eec44040ff533d90d26c6161" ], "author": { "name": "Chris Wright", "email": "chrisw@osdl.org", "time": "Wed May 11 10:55:10 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed May 11 10:55:10 2005 +0100" }, "message": "Add audit_log_type\n\nAdd audit_log_type to allow callers to specify type and pid when logging.\nConvert audit_log to wrapper around audit_log_type. Could have\nconverted all audit_log callers directly, but common case is default\nof type AUDIT_KERNEL and pid 0. Update audit_log_start to take type\nand pid values when creating a new audit_buffer. Move sequences that\ndid audit_log_start, audit_log_format, audit_set_type, audit_log_end,\nto simply call audit_log_type directly. This obsoletes audit_set_type\nand audit_set_pid, so remove them.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "197c69c6afd2deb7eec44040ff533d90d26c6161", "tree": "a44d7170fe20d6119eff6e656d39be623ed6131a", "parents": [ "804a6a49d874841a98ebea3247ad2e672812ad6a" ], "author": { "name": "Chris Wright", "email": "chrisw@osdl.org", "time": "Wed May 11 10:54:05 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed May 11 10:54:05 2005 +0100" }, "message": "Move ifdef CONFIG_AUDITSYSCALL to header\n\nRemove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c.\nMove these dependencies to audit.h with the rest.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "804a6a49d874841a98ebea3247ad2e672812ad6a", "tree": "84bd717927666811d55f31346387f8cb99dff346", "parents": [ "5a241d77039a2632e81070619d5733258728f8bd" ], "author": { "name": "Chris Wright", "email": "chrisw@osdl.org", "time": "Wed May 11 10:52:45 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Wed May 11 10:52:45 2005 +0100" }, "message": "Audit requires CONFIG_NET\n\nAudit now actually requires netlink. So make it depend on CONFIG_NET, \nand remove the inline dependencies on CONFIG_NET.\n\nSigned-off-by: Chris Wright \u003cchrisw@osdl.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "c2f0c7c356dc9ae15419f00c725a2fcc58eeff58", "tree": "2b765b791115e0e85b45bc98800fd2650b23155b", "parents": [ "2512809255d018744fe6c2f5e996c83769846c07" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri May 06 12:38:39 2005 +0100" }, "committer": { "name": "David Woodhouse", "email": "dwmw2@shinybook.infradead.org", "time": "Fri May 06 12:38:39 2005 +0100" }, "message": "The attached patch addresses the problem with getting the audit daemon \nshutdown credential information. It creates a new message type \nAUDIT_TERM_INFO, which is used by the audit daemon to query who issued the \nshutdown. \n\nIt requires the placement of a hook function that gathers the information. The \nhook is after the DAC \u0026 MAC checks and before the function returns. Racing \nthreads could overwrite the uid \u0026 pid - but they would have to be root and \nhave policy that allows signalling the audit daemon. That should be a \nmanageable risk.\n\nThe userspace component will be released later in audit 0.7.2. When it \nreceives the TERM signal, it queries the kernel for shutdown information. \nWhen it receives it, it writes the message and exits. The message looks \nlike this:\n\ntype\u003dDAEMON msg\u003dauditd(1114551182.000) auditd normal halt, sending pid\u003d2650 \nuid\u003d525, auditd pid\u003d1685\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "456be6cd90dbbb9b0ea01d56932d56d110d51cf7", "tree": "27f0d001610f686d11ff460cb6c848a599c8ca4f", "parents": [ "37509e749dc2072e667db806ef24b9e897f61b8a" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri Apr 29 17:30:07 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 17:30:07 2005 +0100" }, "message": "[AUDIT] LOGIN message credentials\n\nAttached is a new patch that solves the issue of getting valid credentials \ninto the LOGIN message. The current code was assuming that the audit context \nhad already been copied. This is not always the case for LOGIN messages.\n\nTo solve the problem, the patch passes the task struct to the function that \nemits the message where it can get valid credentials.\n\nSigned-off-by: Steve Grubb \u003csgrubb@redhat.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "c94c257c88c517f251da273a15c654224c7b6e21", "tree": "992dd50f6bb13a70b04450cdfe0dbfb3c7b17ef5", "parents": [ "85c8721ff3bc96b702427a440616079e8daf8a2f" ], "author": { "name": "Serge Hallyn", "email": "serue@us.ibm.com", "time": "Fri Apr 29 16:27:17 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:27:17 2005 +0100" }, "message": "Add audit uid to netlink credentials\n\nMost audit control messages are sent over netlink.In order to properly\nlog the identity of the sender of audit control messages, we would like\nto add the loginuid to the netlink_creds structure, as per the attached\npatch.\n\nSigned-off-by: Serge Hallyn \u003cserue@us.ibm.com\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "85c8721ff3bc96b702427a440616079e8daf8a2f", "tree": "1232ac4ebbd6d2453ee4d4a104003273ced20440", "parents": [ "67eb81e1686f44bcf8f005b296213fd2c21b4719" ], "author": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:23:29 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:23:29 2005 +0100" }, "message": "audit: update pointer to userspace tools, remove emacs mode tags\n" }, { "commit": "d812ddbb89e323d054a7d073466225966c8350c8", "tree": "469e3e7bb7d1ca450059fc1b45660b8bc6452dc7", "parents": [ "2fd6f58ba6efc82ea2c9c2630f7ff5ed9eeaf34a" ], "author": { "name": "Steve Grubb", "email": "sgrubb@redhat.com", "time": "Fri Apr 29 16:09:52 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:09:52 2005 +0100" }, "message": "[AUDIT] Fix signedness of \u0027serial\u0027 in various routines.\n\nAttached is a patch that corrects a signed/unsigned warning. I also noticed\nthat we needlessly init serial to 0. That only needs to occur if the kernel\nwas compiled without the audit system.\n\n-Steve Grubb\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "2fd6f58ba6efc82ea2c9c2630f7ff5ed9eeaf34a", "tree": "87cf236a78ad242ae01f1b71c289131e6d1c0662", "parents": [ "ea3834d9fb348fb1144ad3affea22df933eaf62e" ], "author": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:08:28 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 16:08:28 2005 +0100" }, "message": "[AUDIT] Don\u0027t allow ptrace to fool auditing, log arch of audited syscalls.\n\nWe were calling ptrace_notify() after auditing the syscall and arguments,\nbut the debugger could have _changed_ them before the syscall was actually\ninvoked. Reorder the calls to fix that.\n\nWhile we\u0027re touching ever call to audit_syscall_entry(), we also make it\ntake an extra argument: the architecture of the syscall which was made,\nbecause some architectures allow more than one type of syscall.\n\nAlso add an explicit success/failure flag to audit_syscall_exit(), for\nthe benefit of architectures which return that in a condition register\nrather than only returning a single register.\n\nChange type of syscall return value to \u0027long\u0027 not \u0027int\u0027.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "83c7d09173fdb6b06b109e65895392db3e49ac9c", "tree": "3f48367a4d1413e221a5367bcd0cf8df7322c368", "parents": [ "c60c390620e0abb60d4ae8c43583714bda27763f" ], "author": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 15:54:44 2005 +0100" }, "committer": { "name": "", "email": "dwmw2@shinybook.infradead.org", "time": "Fri Apr 29 15:54:44 2005 +0100" }, "message": "AUDIT: Avoid log pollution by untrusted strings.\n\nWe log strings from userspace, such as arguments to open(). These could\nbe formatted to contain \\n followed by fake audit log entries. Provide\na function for logging such strings, which gives a hex dump when the\nstring contains anything but basic printable ASCII characters. Use it\nfor logging filenames.\n\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "219f0817038cabc722968e914490adf6b686499e", "tree": "13b64537abe906645ee22843e146e21958236219", "parents": [ "865108d13801d39ec038bdc82b5bec5e1eaffa9d" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Apr 18 10:47:35 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Mon Apr 18 10:47:35 2005 -0700" }, "message": "[PATCH] SELinux: fix deadlock on dcache lock\n\nThis fixes a deadlock on the dcache lock detected during testing at IBM\nby moving the logging of the current executable information from the\nSELinux avc_audit function to audit_log_exit (via an audit_log_task_info\nhelper) for processing upon syscall exit. \n\nFor consistency, the patch also removes the logging of other\ntask-related information from avc_audit, deferring handling to\naudit_log_exit instead. \n\nThis allows simplification of the avc_audit code, allows the exe\ninformation to be obtained more reliably, always includes the comm\ninformation (useful for scripts), and avoids including bogus task\ninformation for checks performed from irq or softirq. \n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: James Morris \u003cjmorris@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n" }, { "commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "tree": "0bba044c4ce775e45a88a51686b5d9f90697ea9d", "parents": [], "author": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@ppc970.osdl.org", "time": "Sat Apr 16 15:20:36 2005 -0700" }, "message": "Linux-2.6.12-rc2\n\nInitial git repository build. I\u0027m not bothering with the full history,\neven though we have it. We can create a separate \"historical\" git\narchive of that later if we want to, and in the meantime it\u0027s about\n3.2GB when imported into git - space that would just make the early\ngit days unnecessarily complicated, when we don\u0027t have a lot of good\ninfrastructure for it.\n\nLet it rip!\n" } ] }