Add the operation performed (register or replace) to the NETFILTER_CFG
record.
Here is the sample record:
type=NETFILTER_CFG msg=audit(1494981627.248:9764): family=7 table=broute
entries=0 op=replace
See: https://github.com/linux-audit/audit-kernel/issues/25
Signed-off-by: Richard Guy Briggs <[email protected]>
---
include/linux/audit.h | 8 ++++----
kernel/auditsc.c | 7 ++++---
net/bridge/netfilter/ebtables.c | 4 ++--
net/netfilter/x_tables.c | 3 ++-
4 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 96cabb095eed..5eab4d898c26 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -379,7 +379,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
extern void __audit_fanotify(unsigned int response);
extern void __audit_tk_injoffset(struct timespec64 offset);
extern void __audit_ntp_log(const struct audit_ntp_data *ad);
-extern void __audit_nf_cfg(const char *name, u8 af, int nentries);
+extern void __audit_nf_cfg(const char *name, u8 af, int nentries, int op);
static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
{
@@ -515,10 +515,10 @@ static inline void audit_ntp_log(const struct
audit_ntp_data *ad)
__audit_ntp_log(ad);
}
-static inline void audit_nf_cfg(const char *name, u8 af, int nentries)
+static inline void audit_nf_cfg(const char *name, u8 af, int nentries, int op)
{
if (!audit_dummy_context())
- __audit_nf_cfg(name, af, nentries);
+ __audit_nf_cfg(name, af, nentries, op);
}
extern int audit_n_rules;
@@ -654,7 +654,7 @@ static inline void audit_ntp_log(const struct
audit_ntp_data *ad)
static inline void audit_ptrace(struct task_struct *t)
{ }
-static inline void audit_nf_cfg(const char *name, u8 af, int nentries)
+static inline void audit_nf_cfg(const char *name, u8 af, int nentries, int op)
{ }
#define audit_n_rules 0
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e1df4233cd3..999ac184246b 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2545,7 +2545,7 @@ void __audit_ntp_log(const struct audit_ntp_data *ad)
audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST);
}
-void __audit_nf_cfg(const char *name, u8 af, int nentries)
+void __audit_nf_cfg(const char *name, u8 af, int nentries, int op)
{
struct audit_buffer *ab;
struct audit_context *context = audit_context();
@@ -2555,8 +2555,9 @@ void __audit_nf_cfg(const char *name, u8 af, int nentries)
ab = audit_log_start(context, GFP_KERNEL, AUDIT_NETFILTER_CFG);
if (!ab)
return; /* audit_panic or being filtered */
- audit_log_format(ab, "table=%s family=%u entries=%u",
- name, af, nentries);
+ audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
+ name, af, nentries,
+ op ? "replace" : "register");
audit_log_end(ab);
}
EXPORT_SYMBOL_GPL(__audit_nf_cfg);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 58126547b175..baff2f05af43 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1049,7 +1049,7 @@ static int do_replace_finish(struct net *net, struct
ebt_replace *repl,
vfree(counterstmp);
if (audit_enabled)
- audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries);
+ audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries, 1);
return ret;
free_unlock:
@@ -1220,7 +1220,7 @@ int ebt_register_table(struct net *net, const struct
ebt_table *input_table,
}
if (audit_enabled)
- audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries);
+ audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries, 0);
return ret;
free_unlock:
mutex_unlock(&ebt_mutex);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index c0416ae52f7f..4ae4f7bf8946 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1402,7 +1402,8 @@ struct xt_table_info *xt_replace_table(struct xt_table
*table,
}
if (audit_enabled)
- audit_nf_cfg(table->name, table->af, private->number);
+ audit_nf_cfg(table->name, table->af, private->number,
+ private->number);
return private;
}
--
1.8.3.1
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
