[PATCH] Audit capabilities

Stephen Smalley sds at epoch.ncsc.mil
Thu Jan 13 20:38:21 UTC 2005


On Fri, 2005-01-07 at 11:16, Serge Hallyn wrote:
> Attached is a new patch to introduce CAP_AUDIT_CONTROL and
> CAP_AUDIT_WRITE.  Thank you all for the clarifications on appropriate
> caps.
> 
> Purpose: Audit message authentication is being done on the process
> receiving the message, which may not be the process sending the message.
> This patch sets the sk_buff eff_caps according to the sender
> permissions, and authenticates audit message handling based on that.  It
> also switches from using CAP_SYS_ADMIN to using AUDIT capabilities.
> 
> Changelog:
> 12-20-2005: Switch from CAP_[SYS,NET]_ADMIN to AUDIT capabilities.
> 12-27-2005: Use dummy_capget in dummy_netlink_send, and correctly mask
> the skb's eff_cap according to selinux perms.
> 12-28-2005: Use avc_has_perm_noaudit in selinux_netlink_send to use
> cached decisions.
> 01-06-2005: Switch to using CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE.

Any reason this hasn't been submitted upstream?

-- 
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency




More information about the Linux-audit mailing list