Richard Guy Briggs 571e5c0efc audit: add OPENAT2 record to list "how" info ... Since the openat2(2) syscall uses a struct open_how pointer to communicate its parameters they are not usefully recorded by the audit SYSCALL record's four existing arguments. Add a new audit record type OPENAT2 that reports the parameters in its third argument, struct open_how with fields oflag, mode and resolve. The new record in the context of an event would look like: time->Wed Mar 17 16:28:53 2021 type=PROCTITLE msg=audit(1616012933.531:184): proctitle= 73797363616C6C735F66696C652F6F70656E617432002F746D702F61756469742D 7465737473756974652D737641440066696C652D6F70656E617432 type=PATH msg=audit(1616012933.531:184): item=1 name="file-openat2" inode=29 dev=00:1f mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1616012933.531:184): item=0 name="/root/rgb/git/audit-testsuite/tests" inode=25 dev=00:1f mode=040700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1616012933.531:184): cwd="/root/rgb/git/audit-testsuite/tests" type=OPENAT2 msg=audit(1616012933.531:184): oflag=0100302 mode=0600 resolve=0xa type=SYSCALL msg=audit(1616012933.531:184): arch=c000003e syscall=437 success=yes exit=4 a0=3 a1=7ffe315f1c53 a2=7ffe315f1550 a3=18 items=2 ppid=528 pid=540 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="openat2" exe="/root/rgb/git/audit-testsuite/tests/syscalls_file/openat2" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="testsuite-1616012933-bjAUcEPO" Link: https://lore.kernel.org/r/d23fbb89186754487850367224b060e26f9b7181.1621363275.git.rgb@redhat.com Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> [PM: tweak subject, wrap example, move AUDIT_OPENAT2 to 1337] Signed-off-by: Paul Moore <paul@paul-moore.com>		2021-10-04 12:09:27 -04:00
..
acpi	Merge branches 'pm-cpufreq', 'pm-sleep' and 'pm-em'	2021-09-10 20:26:08 +02:00
asm-generic	ARM development updates for 5.15:	2021-09-09 13:25:49 -07:00
clocksource
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2021-08-30 12:57:10 -07:00
drm
dt-bindings	linux-watchdog 5.15-rc1 tag	2021-09-07 13:52:46 -07:00
keys
kunit
kvm
linux	audit: add OPENAT2 record to list "how" info	2021-10-04 12:09:27 -04:00
math-emu
media
memory
misc
net	flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common()	2021-09-02 11:44:19 +01:00
pcmcia
ras
rdma
scsi
soc	Merge branches 'clk-nvidia', 'clk-rockchip', 'clk-at91' and 'clk-vc5' into clk-next	2021-09-01 15:26:58 -07:00
sound	ASoC: Updates for v5.15	2021-08-30 14:57:03 +02:00
target
trace	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
uapi	audit: add OPENAT2 record to list "how" info	2021-10-04 12:09:27 -04:00
vdso
video
xen