netfilter: nf_tables: Deduplicate nft_register_obj audit logs

Browse source

When adding/updating an object, the transaction handler emits suitable
audit log entries already, the one in nft_obj_notify() is redundant. To
fix that (and retain the audit logging from objects' 'update' callback),
Introduce an "audit log free" variant for internal use.

Fixes: c520292f29 ("audit: log nftables configuration change events once per table")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Phil Sutter 2023-09-23 03:53:50 +02:00 • committed by Florian Westphal

parent 203bb9d398

commit 0d880dc6f0

2 changed files with 48 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

44

net/netfilter/nf_tables_api.c

View file

20

tools/testing/selftests/netfilter/nft_audit.sh

View file