moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[PATCH] fix missed create event for directory audit

Browse Source 
When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Amy Griffis
2006-07-13 13:16:39 -04:00
committed by Al Viro
parent 3e2efce067
commit 73d3ec5aba
4 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/linux/audit.h
View File

@@ -327,7 +327,7 @@ extern void __audit_getname(const char *name);
extern void audit_putname(const char *name);
extern void __audit_inode(const char *name, const struct inode *inode);
extern void __audit_inode_child(const char *dname, const struct inode *inode,
unsigned long pino);
const struct inode *parent);
extern void __audit_inode_update(const struct inode *inode);
static inline void audit_getname(const char *name)
{
@@ -339,10 +339,10 @@ static inline void audit_inode(const char *name, const struct inode *inode) {
__audit_inode(name, inode);
}
static inline void audit_inode_child(const char *dname,
const struct inode *inode,
unsigned long pino) {
const struct inode *inode,
const struct inode *parent) {
if (unlikely(current->audit_context))
__audit_inode_child(dname, inode, pino);
__audit_inode_child(dname, inode, parent);
}
static inline void audit_inode_update(const struct inode *inode) {
if (unlikely(current->audit_context))