[PATCH 5/6] audit: add restricted capability read-only netlink multicast socket

Add a netlink multicast socket with one group to kaudit for best-effort delivery to read-only userspace clients such as systemd, in addition to the existing bidirectional unicast auditd userspace client. Currently, auditd is intended to use the CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE capabilities,

[PATCH 0/6] audit: add restricted capability read-only netlink multicast socket

Hi, This is a patch set Eric Paris and I have been working on to add a restricted capability read-only netlink multicast socket to kaudit to enable userspace clients such as systemd to consume audit logs, in addition to the bidirectional auditd userspace client. Currently, auditd has the

[PATCH 3/6] audit: move kaudit thread start from auditd registration to kaudit init

The kauditd_thread() task was started only after the auditd userspace daemon registers itself with kaudit. This was fine when only auditd consumed messages from the kaudit netlink unicast socket. With the addition of a multicast group to that socket it is more convenient to have the thread start

[PATCH 6/6] audit: send multicast messages only if there are listeners

Test first to see if there are any userspace multicast listeners bound to the socket before starting the multicast send work. Signed-off-by: Richard Guy Briggs rbri...@redhat.com --- kernel/audit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/audit.c b/kernel/audit.c index

[PATCH 2/6] audit: flatten kauditd_thread wait queue code

The wait queue control code in kauditd_thread() was nested deeper than necessary. The function has been flattened for better legibility. Signed-off-by: Richard Guy Briggs rbri...@redhat.com --- This is a code clean up in preparation to add a multicast netlink socket to kaudit for read-only

[PATCH 4/6] netlink: add send and receive capability requirement and capability flags

Currently netlink socket permissions are controlled by the NL_CFG_F_NONROOT_{RECV,SEND} flags in the kernel socket configuration or by the CAP_NET_ADMIN capability of the client. The former allows non-root users access to the socket. The latter allows all network admin clients access to the