[PATCH 2/2] audit: log binding and unbinding to netlink multicast socket
Paul Moore
pmoore at redhat.com
Fri Jul 24 22:58:42 UTC 2015
On Thursday, July 23, 2015 04:45:19 PM Steve Grubb wrote:
> Log information about programs connecting and disconnecting to the audit
> netlink multicast socket. This is needed so that during investigations a
> security officer can tell who or what had access to the audit trail. This
> helps to meet the FAU_SAR.2 requirement for Common Criteria.
>
> Signed-off-by: Steve Grubb <sgrubb at redhat.com>
> ---
> include/uapi/linux/audit.h | 1 +
> kernel/audit.c | 30 ++++++++++++++++++++++++++++--
> 2 files changed, 29 insertions(+), 2 deletions(-)
...
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 29fb38b..3253f1b 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1135,13 +1135,36 @@ void audit_log_task_simple(struct audit_buffer *ab,
> struct task_struct *tsk) }
> EXPORT_SYMBOL(audit_log_task_simple);
>
> +static void audit_log_bind(int group, const char *op, int err)
> +{
Hmmm, how about a name tweak to indicate multicast? How about
audit_log_multicast_bind()?
> + struct audit_buffer *ab;
> +
> + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_EVENT_LISTENER);
> + if (!ab)
> + return;
> +
> + audit_log_task_simple(ab, current);
> + audit_log_format(ab, " nlnk-grp=%d", group);
> + audit_log_format(ab, " op=%s", op);
> + audit_log_format(ab, " res=%d", !err);
> + audit_log_end(ab);
Any reason we can't do this with one audit_log_format() call?
audit_log_format(ab, "nlnk-grp=%d op=%s res=%d", group, op, !err);
--
paul moore
security @ redhat
More information about the Linux-audit
mailing list