-
- Downloads
[PATCH] audit signal recipients
When auditing syscalls that send signals, log the pid and security context for each target process. Optimize the data collection by adding a counter for signal-related rules, and avoiding allocating an aux struct unless we have more than one target process. For process groups, collect pid/context data in blocks of 16. Move the audit_signal_info() hook up in check_kill_permission() so we audit attempts where permission is denied. Signed-off-by:Amy Griffis <amy.griffis@hp.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
Showing
- arch/ia64/kernel/audit.c 9 additions, 0 deletionsarch/ia64/kernel/audit.c
- arch/powerpc/kernel/audit.c 9 additions, 0 deletionsarch/powerpc/kernel/audit.c
- arch/s390/kernel/audit.c 9 additions, 0 deletionsarch/s390/kernel/audit.c
- arch/sparc64/kernel/audit.c 9 additions, 0 deletionsarch/sparc64/kernel/audit.c
- arch/x86_64/kernel/audit.c 9 additions, 0 deletionsarch/x86_64/kernel/audit.c
- include/linux/audit.h 3 additions, 0 deletionsinclude/linux/audit.h
- kernel/audit.h 8 additions, 5 deletionskernel/audit.h
- kernel/auditfilter.c 47 additions, 1 deletionkernel/auditfilter.c
- kernel/auditsc.c 92 additions, 19 deletionskernel/auditsc.c
- kernel/signal.c 6 additions, 4 deletionskernel/signal.c
- lib/audit.c 5 additions, 0 deletionslib/audit.c
Loading
Please register or sign in to comment