[PATCH 0/5] RFC v2: AF_ALG auditing

[Miloslav Trmač]

Hello,
these patches add support for auditing uses of the AF_ALG protocol family
developed by Herbert Xu to provide user-space access to kernel crypto
accelerators.

One new record is defined: AUDIT_CRYPTO_USERSPACE_OP.  An audited event
is always caused by a syscall, and all other syscall-related data
(process identity, syscall result) is audited in the usual records.

To disable auditing crypto by default and to allow the users to
selectively enable them using filters, a new filter field
AUDIT_CRYPTO_OP is defined; auditing of all crypto operations can
thus be enabled using (auditctl -a exit,always -F crypto_op!=0).

Changes since the previous version:
* Use audit_aux_data instead of a separate linked list
* Don't overwrite initial values of "err" by 0 in algif_skcipher.c
    Mirek

Miloslav Trmač (5):
  Add general crypto auditing infrastructure
  Add unique IDs to AF_ALG sockets
  Add "alg_name" operation to af_alg_type.
  Audit type-independent events
  Audit type-specific crypto operations

 crypto/af_alg.c         |  110 ++++++++++++++++++++++++++++++++++++++++++++++-
 crypto/algif_hash.c     |   35 +++++++++++++--
 crypto/algif_skcipher.c |   28 +++++++++++-
 include/crypto/if_alg.h |   17 +++++--
 include/linux/audit.h   |   22 +++++++++
 kernel/auditfilter.c    |    2 +
 kernel/auditsc.c        |   97 +++++++++++++++++++++++++++++++++++++++++
 7 files changed, 296 insertions(+), 15 deletions(-)

-- 
1.7.3.2