[PATCH] field-dictionary: add ioctlcmd

william.c.roberts at intel.com william.c.roberts at intel.com
Fri Jul 15 19:55:13 UTC 2016


From: William Roberts <william.c.roberts at intel.com>

Per-request ioctlcmd controls were added to SE Linux, however
the audit field dictionary was not updated.

This patch updates that dictionary.

Signed-off-by: William Roberts <william.c.roberts at intel.com>
---
 specs/fields/field-dictionary.csv | 1 +
 1 file changed, 1 insertion(+)

diff --git a/specs/fields/field-dictionary.csv b/specs/fields/field-dictionary.csv
index a645085..5a922e5 100644
--- a/specs/fields/field-dictionary.csv
+++ b/specs/fields/field-dictionary.csv
@@ -82,6 +82,7 @@ inode,numeric,inode number,
 inode_gid,numeric,group id of the inode's owner,
 inode_uid,numeric,user id of the inode's owner,
 invalid_context,encoded,SELinux context,
+ioctlcmd,numeric,The request argument to the ioctl syscall,
 ipx-net,numeric,IPX network number,
 item,numeric,which item is being recorded,
 items,numeric,the number of path records in the event,
-- 
1.9.1




More information about the Linux-audit mailing list