audit: add missing syscalls to PERM class tables

Add missing file metadata syscalls to the audit PERM class tables,
addressing gaps where certain file operations were not properly
classified for audit rule matching.

Changes:
- audit_change_attr.h: Add file_setattr

- audit_read.h: Add quotactl_fd, file_getattr, stat, stat64, lstat,
  lstat64, fstat, fstat64, newfstatat, fstatat64, and statx

- audit_write.h: Add quotactl_fd

Architecture-specific and conditionally-compiled syscalls are guarded
with #ifdef.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ricardo Robaina 2026-06-12 11:14:36 -03:00 committed by Paul Moore
parent dc59e4fea9
commit c0d73c0938
3 changed files with 37 additions and 0 deletions

View File

@ -40,3 +40,6 @@ __NR_link,
#ifdef __NR_linkat
__NR_linkat,
#endif
#ifdef __NR_file_setattr
__NR_file_setattr,
#endif

View File

@ -3,6 +3,9 @@
__NR_readlink,
#endif
__NR_quotactl,
#ifdef __NR_quotactl_fd
__NR_quotactl_fd,
#endif
__NR_listxattr,
#ifdef __NR_listxattrat
__NR_listxattrat,
@ -18,3 +21,31 @@ __NR_fgetxattr,
#ifdef __NR_readlinkat
__NR_readlinkat,
#endif
#ifdef __NR_file_getattr
__NR_file_getattr,
#endif
#ifdef __NR_stat
__NR_stat,
#endif
#ifdef __NR_stat64
__NR_stat64,
#endif
#ifdef __NR_lstat
__NR_lstat,
#endif
#ifdef __NR_lstat64
__NR_lstat64,
#endif
#ifdef __NR_fstat
__NR_fstat,
#endif
#ifdef __NR_fstat64
__NR_fstat64,
#endif
#ifdef __NR_newfstatat
__NR_newfstatat,
#endif
#ifdef __NR_fstatat64
__NR_fstatat64,
#endif
__NR_statx,

View File

@ -5,6 +5,9 @@ __NR_acct,
__NR_swapon,
#endif
__NR_quotactl,
#ifdef __NR_quotactl_fd
__NR_quotactl_fd,
#endif
#ifdef __NR_truncate
__NR_truncate,
#endif