diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2022-02-22 11:44:51 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2022-02-22 13:51:40 -0500 |
| commit | 272ceeaea355214b301530e262a0df8600bfca95 (patch) | |
| tree | 98bbdd67587240bcedf02cc735d1e7fb351bfdf6 /kernel/audit.h | |
| parent | e783362eb54cd99b2cac8b3a9aeac942e6f6ac07 (diff) | |
audit: log AUDIT_TIME_* records only from rules
AUDIT_TIME_* events are generated when there are syscall rules present
that are not related to time keeping. This will produce noisy log
entries that could flood the logs and hide events we really care about.
Rather than immediately produce the AUDIT_TIME_* records, store the data
in the context and log it at syscall exit time respecting the filter
rules.
Note: This eats the audit_buffer, unlike any others in show_special().
Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed style/whitespace issues]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/audit.h')
| -rw-r--r-- | kernel/audit.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/audit.h b/kernel/audit.h index c4498090a5bd..58b66543b4d5 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -201,6 +201,10 @@ struct audit_context { struct { char *name; } module; + struct { + struct audit_ntp_data ntp_data; + struct timespec64 tk_injoffset; + } time; }; int fds[2]; struct audit_proctitle proctitle; |