netfilter: nf_tables: Deduplicate nft_register_obj audit logs

Browse source

[ Upstream commit 0d880dc6f0 ]

When adding/updating an object, the transaction handler emits suitable
audit log entries already, the one in nft_obj_notify() is redundant. To
fix that (and retain the audit logging from objects' 'update' callback),
Introduce an "audit log free" variant for internal use.

Fixes: c520292f29 ("audit: log nftables configuration change events once per table")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Phil Sutter 2023-09-23 03:53:50 +02:00 • committed by Greg Kroah-Hartman

parent e1bbe4afe1

commit 7ff9a9857b

2 changed files with 48 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

44

net/netfilter/nf_tables_api.c

View file

20

tools/testing/selftests/netfilter/nft_audit.sh

View file