On Nov 22, 2024 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <[email protected]> wrote: > > Add audit support for unix_stream_connect, unix_may_send, task_kill, and > file_send_sigiotask hooks. > > Audit event sample: > > type=LL_DENY [...]: domain=195ba459b blockers=scope_abstract_unix_socket > path=00666F6F
Similar to 17/23, I believe the SOCKADDR record should already capture the socket address information. It would also be nice to see an example record on a signal event. > Cc: Günther Noack <[email protected]> > Cc: Tahera Fahimi <[email protected]> > Signed-off-by: Mickaël Salaün <[email protected]> > Link: https://lore.kernel.org/r/[email protected] > --- > Changes since v1: > - New patch. > --- > security/landlock/audit.c | 8 ++++++ > security/landlock/audit.h | 2 ++ > security/landlock/task.c | 58 ++++++++++++++++++++++++++++++++++++--- > 3 files changed, 64 insertions(+), 4 deletions(-) -- paul-moore.com
