Linus, This is a bit early, but due to some personal scheduling I'd rather send this to you now, and you always mention you prefer to get pull requests early (perhaps not this early?) so here is hoping this is a win-win.
Here are the highlights for the audit changes queued for the Linux v7.0 merge window: - Improve the NETFILTER_PKT audit records Add source and destination ports to the NETFILTER_PKT audit records while also consolidating a lot of the code into a new, singular audit_log_nf_skb() function. This new approach to structuring the NETFILTER_PKT record generation should elimiate some unnecessary overhead when audit is not built into the kernel. - Update the audit syscall classifier code Add the listxattrat(), getxattrat(), and fchmodat2() syscall to the audit code which classifies syscalls into categories of operations, e.g. "read" or "change attributes". - Move the syscall classifier declarations into audit_arch.h Shuffle around some header file declarations to resolve some sparse warnings. Paul -- The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8: Linux 6.19-rc1 (2025-12-14 16:05:07 +1200) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20260203 for you to fetch changes up to 76489955c6d4a065ca69dc88faf7a50a59b66f35: audit: move the compat_xxx_class[] extern declarations to audit_arch.h (2026-01-09 16:37:59 -0500) ---------------------------------------------------------------- audit/stable-7.0 PR 20260203 ---------------------------------------------------------------- Ben Dooks (1): audit: move the compat_xxx_class[] extern declarations to audit_arch.h Jeffrey Bencteux (2): audit: add fchmodat2() to change attributes class audit: add missing syscalls to read class Ricardo Robaina (2): audit: add audit_log_nf_skb helper function audit: include source and destination ports to NETFILTER_PKT include/asm-generic/audit_change_attr.h | 3 include/asm-generic/audit_read.h | 6 include/linux/audit.h | 14 +- include/linux/audit_arch.h | 7 + kernel/audit.c | 159 ++++++++++++++++++++++++ net/netfilter/nft_log.c | 58 -------- net/netfilter/xt_AUDIT.c | 58 -------- 7 files changed, 185 insertions(+), 120 deletions(-) -- paul-moore.com
