diff options
| author | Kees Cook <keescook@chromium.org> | 2012-07-25 17:29:08 -0700 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2012-07-29 21:43:08 +0400 |
| commit | a51d9eaa41866ab6b4b6ecad7b621f8b66ece0dc (patch) | |
| tree | f8ab532f946ec7f9ccdabb6a394d952981084122 /kernel | |
| parent | 800179c9b8a1e796e441674776d11cd4c05d61d7 (diff) | |
fs: add link restriction audit reporting
Adds audit messages for unexpected link restriction violations so that
system owners will have some sort of potentially actionable information
about misbehaving processes.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/audit.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/kernel/audit.c b/kernel/audit.c index 1c7f2c61416..fda8bd9e1d3 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1450,6 +1450,27 @@ void audit_log_key(struct audit_buffer *ab, char *key) } /** + * audit_log_link_denied - report a link restriction denial + * @operation: specific link opreation + * @link: the path that triggered the restriction + */ +void audit_log_link_denied(const char *operation, struct path *link) +{ + struct audit_buffer *ab; + + ab = audit_log_start(current->audit_context, GFP_KERNEL, + AUDIT_ANOM_LINK); + audit_log_format(ab, "op=%s action=denied", operation); + audit_log_format(ab, " pid=%d comm=", current->pid); + audit_log_untrustedstring(ab, current->comm); + audit_log_d_path(ab, " path=", link); + audit_log_format(ab, " dev="); + audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id); + audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino); + audit_log_end(ab); +} + +/** * audit_log_end - end one audit record * @ab: the audit_buffer * |