[PATCH 0/2] audit string fields interface + consumer

Amy Griffis amy.griffis at hp.com
Wed Jan 11 18:59:21 UTC 2006


Following are two patches, the first of which provides an interface
for specifying audit rules with string fields.  The second patch adds
a new string field AUDIT_WATCH.  These patches are an update of the
previous audit interface patches I have posted to this list.

These patches are functionally similar to the previous posts; however,
I believe you will find the organization of the code to be quite
different and much improved.  I have updated the interface based on
the feedback I received.  I also resolved the issue of differentiating
between inode-based and path-based (or watch-based) filtering by
creating a new field AUDIT_WATCH and adding it to the switch in
audit_filter_rules().

Following is a summary of the interface.

A new struct audit_rule_data and corresponding netlink message types
have been added.  Additionally, the SELinux nlmsg_audit_perms[] table
has been updated with the new netlink message types.

The new struct allows userspace to supply one or more string fields
packed in a variable length buffer.  The kernel expects the buffer to
be neither null-delimited nor null-terminated.

The length of string data for a given field is provided as its value
element in the array.  The kernel provides the buflen element for
convenience on rule listing, to allow userspace to allocate memory for
the buffer without walking the array to tabulate lengths.  Buflen is
ignored coming from userspace.  Instead, the kernel ensures that the
total of the lengths specified in the value elements do not exceed the
length of the message payload minus sizeof(struct audit_rule_data).

Several routines have been added to auditfilter.c to translate between
the kernel's rule representation and the two userspace rule
representations using structs audit_rule and audit_rule_data.




More information about the Linux-audit mailing list