Misc audit patches (resend again...); the most intrusive one is AUDIT_FD_PAIR, allowing to log descriptor numbers from syscalls that do not return them in usual way (i.e. pipe() and socketpair()). It took some massage of the failure exits in sys_socketpair(); the rest is absolutely trivial. Please, pull from git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current.git/ audit.b37
Al Viro (1): AUDIT_FD_PAIR Steve Grubb (2): minor update to rule add/delete messages (ver 2) audit config lockdown fs/pipe.c | 7 ++ include/linux/audit.h | 9 ++ kernel/audit.c | 216 +++++++++++++++++++++++++++++++++++------------- kernel/auditfilter.c | 9 +- kernel/auditsc.c | 40 +++++++++ net/socket.c | 52 +++++++++--- 6 files changed, 257 insertions(+), 76 deletions(-) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/