summaryrefslogtreecommitdiff
path: root/include/linux/audit.h
diff options
context:
space:
mode:
authorSteve Grubb <sgrubb@redhat.com>2007-04-19 10:28:21 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2007-05-11 05:38:26 -0400
commit0a4ff8c2598b72f2fa9d50aae9e1809e684dbf41 (patch)
tree309f2b2b5874692302862534cd9052a1d96018ba /include/linux/audit.h
parent5712e88f2b0f626a4857c24128810bbf8ce09537 (diff)
[PATCH] Abnormal End of Processes
Hi, I have been working on some code that detects abnormal events based on audit system events. One kind of event that we currently have no visibility for is when a program terminates due to segfault - which should never happen on a production machine. And if it did, you'd want to investigate it. Attached is a patch that collects these events and sends them into the audit system. Signed-off-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'include/linux/audit.h')
-rw-r--r--include/linux/audit.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 22976ddbd264..fccc6e50298a 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -112,6 +112,7 @@
#define AUDIT_FIRST_KERN_ANOM_MSG 1700
#define AUDIT_LAST_KERN_ANOM_MSG 1799
#define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
+#define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */
#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
@@ -377,6 +378,7 @@ static inline void audit_inode_child(const char *dname,
if (unlikely(!audit_dummy_context()))
__audit_inode_child(dname, inode, parent);
}
+void audit_core_dumps(long signr);
static inline void audit_ptrace(struct task_struct *t)
{
@@ -467,6 +469,7 @@ extern int audit_signals;
#define __audit_inode_child(d,i,p) do { ; } while (0)
#define audit_inode(n,i) do { ; } while (0)
#define audit_inode_child(d,i,p) do { ; } while (0)
+#define audit_core_dumps(i) do { ; } while (0)
#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
#define audit_get_loginuid(c) ({ -1; })
#define audit_log_task_context(b) do { ; } while (0)