(Intentionally not sending to the timekeeping maintainers just yet, let's settle on the record contents/format first.)
Signed-off-by: Ondrej Mosnacek <[email protected]> --- kernel/time/timekeeping.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index 4786df904c22..02097a7d225e 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -25,6 +25,7 @@ #include <linux/stop_machine.h> #include <linux/pvclock_gtod.h> #include <linux/compiler.h> +#include <linux/audit.h> #include "tick-internal.h" #include "ntp_internal.h" @@ -2315,6 +2316,16 @@ int do_adjtimex(struct timex *txc) raw_spin_lock_irqsave(&timekeeper_lock, flags); write_seqcount_begin(&tk_core.seq); + /* Only log audit event if the clock was changed/attempted to be changed. + * Based on the logic inside timekeeping_validate_timex(). + * NOTE: We need to log the event before any of the fields get + * overwritten by the output values (__do_adjtimex() does not fail, so + * it is OK to do it here). */ + if ( ( (txc->modes & ADJ_ADJTIME) && !(txc->modes & ADJ_OFFSET_READONLY)) + || (!(txc->modes & ADJ_ADJTIME) && txc->modes) + || (txc->modes & ADJ_SETOFFSET)) + audit_adjtime(txc); + orig_tai = tai = tk->tai_offset; ret = __do_adjtimex(txc, &ts, &tai); -- 2.17.1 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
