netfilter: create audit records for x_tables replaces
The setsockopt() syscall to replace tables is already recorded in the audit logs. This patch stores additional information such as table name and netfilter protocol. Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Paris <eparis@parisplace.org> Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
43f393caec
commit
fbabf31e4d
@ -104,6 +104,7 @@
|
||||
#define AUDIT_CAPSET 1322 /* Record showing argument to sys_capset */
|
||||
#define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */
|
||||
#define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */
|
||||
#define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */
|
||||
|
||||
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
|
||||
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
|
||||
|
@ -23,6 +23,7 @@
|
||||
#include <linux/mutex.h>
|
||||
#include <linux/mm.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/audit.h>
|
||||
#include <net/net_namespace.h>
|
||||
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table,
|
||||
*/
|
||||
local_bh_enable();
|
||||
|
||||
#ifdef CONFIG_AUDIT
|
||||
if (audit_enabled) {
|
||||
struct audit_buffer *ab;
|
||||
|
||||
ab = audit_log_start(current->audit_context, GFP_KERNEL,
|
||||
AUDIT_NETFILTER_CFG);
|
||||
if (ab) {
|
||||
audit_log_format(ab, "table=%s family=%u entries=%u",
|
||||
table->name, table->af,
|
||||
private->number);
|
||||
audit_log_end(ab);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
return private;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(xt_replace_table);
|
||||
|
Loading…
Reference in New Issue
Block a user