diff options
| author | Paul Moore <paul@paul-moore.com> | 2021-04-18 21:54:47 -0400 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2021-09-19 22:34:38 -0400 |
| commit | 67daf270cebcf7aab4b3292b36f9adf357b23ddc (patch) | |
| tree | 6f5bbbe164b0f6e45c269291b908c4ae1116d17f /kernel/audit_watch.c | |
| parent | 5bd2182d58e9d9c6279b7a8a2f9b41add0e7f9cb (diff) | |
audit: add filtering for io_uring records
This patch adds basic audit io_uring filtering, using as much of the
existing audit filtering infrastructure as possible. In order to do
this we reuse the audit filter rule's syscall mask for the io_uring
operation and we create a new filter for io_uring operations as
AUDIT_FILTER_URING_EXIT/audit_filter_list[7].
Thanks to Richard Guy Briggs for his review, feedback, and work on
the corresponding audit userspace changes.
Acked-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/audit_watch.c')
| -rw-r--r-- | kernel/audit_watch.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c index 2acf7ca49154..698b62b4a2ec 100644 --- a/kernel/audit_watch.c +++ b/kernel/audit_watch.c @@ -183,7 +183,8 @@ int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op) return -EOPNOTSUPP; if (path[0] != '/' || path[len-1] == '/' || - krule->listnr != AUDIT_FILTER_EXIT || + (krule->listnr != AUDIT_FILTER_EXIT && + krule->listnr != AUDIT_FILTER_URING_EXIT) || op != Audit_equal || krule->inode_f || krule->watch || krule->tree) return -EINVAL; |