This patch allow to log audit config change in
audit namespace.
Signed-off-by: Gao feng <[email protected]>
---
kernel/audit.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c
index 92da21d..095f54d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -252,13 +252,15 @@ void audit_log_lost(const char *message)
}
}
-static int audit_log_config_change(char *function_name, int new, int old,
+static int audit_log_config_change(struct audit_namespace *ns,
+ char *function_name,
+ int new, int old,
int allow_changes)
{
struct audit_buffer *ab;
int rc = 0;
- ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+ ab = audit_log_start_ns(ns, NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
if (unlikely(!ab))
return rc;
audit_log_format(ab, "%s=%d old=%d", function_name, new, old);
@@ -267,7 +269,7 @@ static int audit_log_config_change(char *function_name, int
new, int old,
if (rc)
allow_changes = 0; /* Something weird, deny request */
audit_log_format(ab, " res=%d", allow_changes);
- audit_log_end(ab);
+ audit_log_end_ns(ns, ab);
return rc;
}
@@ -282,7 +284,10 @@ static int audit_do_config_change(char *function_name, int
*to_change, int new)
allow_changes = 1;
if (audit_enabled != AUDIT_OFF) {
- rc = audit_log_config_change(function_name, new, old,
allow_changes);
+ rc = audit_log_config_change(&init_audit_ns,
+ function_name,
+ new, old,
+ allow_changes);
if (rc)
allow_changes = 0;
}
@@ -697,7 +702,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct
nlmsghdr *nlh)
new_pid = task_pid_nr_ns(task, &init_pid_ns);
if (audit_enabled != AUDIT_OFF)
- audit_log_config_change("audit_pid", new_pid,
ns->pid, 1);
+ audit_log_config_change(&init_audit_ns,
+ "audit_pid",
+ new_pid,
+ ns->pid, 1);
ns->pid = new_pid;
rcu_read_unlock();
--
1.8.3.1
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
