[PATCH] add rule filterkey

Browse source

Add support for a rule key, which can be used to tie audit records to audit
rules.  This is useful when a watched file is accessed through a link or
symlink, as well as for general audit log analysis.

Because this patch uses a string key instead of an integer key, there is a bit
of extra overhead to do the kstrdup() when a rule fires.  However, we're also
allocating memory for the audit record buffer, so it's probably not that
significant.  I went ahead with a string key because it seems more
user-friendly.

Note that the user must ensure that filterkeys are unique.  The kernel only
checks for duplicate rules.

Signed-off-by: Amy Griffis <amy.griffis@hpd.com>

...

This commit is contained in:

Amy Griffis 2006-06-14 18:45:21 -04:00 • committed by Al Viro

parent 9262e9149f

commit 5adc8a6adc

4 changed files with 78 additions and 36 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

kernel/audit.h

View file

95

kernel/auditfilter.c

View file

15

kernel/auditsc.c

View file