summaryrefslogtreecommitdiff
path: root/include/linux/audit.h
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2012-10-10 15:25:23 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2012-10-12 00:32:01 -0400
commitbfcec7087458812f575d9022b2d151641f34ee84 (patch)
tree6c0f7dd3b016992da8d113ceeaae404c6abc03a1 /include/linux/audit.h
parent78e2e802a8519031e5858595070b39713e26340d (diff)
audit: set the name_len in audit_inode for parent lookups
Currently, this gets set mostly by happenstance when we call into audit_inode_child. While that might be a little more efficient, it seems wrong. If the syscall ends up failing before audit_inode_child ever gets called, then you'll have an audit_names record that shows the full path but has the parent inode info attached. Fix this by passing in a parent flag when we call audit_inode that gets set to the value of LOOKUP_PARENT. We can then fix up the pathname for the audit entry correctly from the get-go. While we're at it, clean up the no-op macro for audit_inode in the !CONFIG_AUDITSYSCALL case. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'include/linux/audit.h')
-rw-r--r--include/linux/audit.h15
1 files changed, 10 insertions, 5 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 26408934ef2d..b11f517dce04 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -456,6 +456,7 @@ extern int audit_classify_arch(int arch);
/* audit_names->type values */
#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
#define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
+#define AUDIT_TYPE_PARENT 2 /* a parent audit record */
#ifdef CONFIG_AUDITSYSCALL
/* These are defined in auditsc.c */
@@ -468,7 +469,8 @@ extern void __audit_syscall_entry(int arch,
extern void __audit_syscall_exit(int ret_success, long ret_value);
extern void __audit_getname(const char *name);
extern void audit_putname(const char *name);
-extern void __audit_inode(const char *name, const struct dentry *dentry);
+extern void __audit_inode(const char *name, const struct dentry *dentry,
+ unsigned int parent);
extern void __audit_inode_child(const struct inode *parent,
const struct dentry *dentry);
extern void __audit_seccomp(unsigned long syscall, long signr, int code);
@@ -505,9 +507,10 @@ static inline void audit_getname(const char *name)
if (unlikely(!audit_dummy_context()))
__audit_getname(name);
}
-static inline void audit_inode(const char *name, const struct dentry *dentry) {
+static inline void audit_inode(const char *name, const struct dentry *dentry,
+ unsigned int parent) {
if (unlikely(!audit_dummy_context()))
- __audit_inode(name, dentry);
+ __audit_inode(name, dentry, parent);
}
static inline void audit_inode_child(const struct inode *parent,
const struct dentry *dentry) {
@@ -660,12 +663,14 @@ static inline void audit_getname(const char *name)
{ }
static inline void audit_putname(const char *name)
{ }
-static inline void __audit_inode(const char *name, const struct dentry *dentry)
+static inline void __audit_inode(const char *name, const struct dentry *dentry,
+ unsigned int parent)
{ }
static inline void __audit_inode_child(const struct inode *parent,
const struct dentry *dentry)
{ }
-static inline void audit_inode(const char *name, const struct dentry *dentry)
+static inline void audit_inode(const char *name, const struct dentry *dentry,
+ unsigned int parent)
{ }
static inline void audit_inode_child(const struct inode *parent,
const struct dentry *dentry)