f9bab2677a
Pull audit updates from Paul Moore:
"Another relatively small pull request for audit, nine patches total.
The only real new bit of functionality is the patch from Richard which
adds the ability to filter records based on the filesystem type.
The remainder are bug fixes and cleanups; the bug fix highlights
include:
- ensuring that we properly audit init/PID-1 (me)
- allowing the audit daemon to shutdown the kernel/auditd connection
cleanly by setting the audit PID to zero (Steve)"
* tag 'audit-pr-20171113' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: filter PATH records keyed on filesystem magic
Audit: remove unused audit_log_secctx function
audit: Allow auditd to set pid to 0 to end auditing
audit: Add new syscalls to the perm=w filter
audit: use audit_set_enabled() in audit_enable()
audit: convert audit_ever_enabled to a boolean
audit: don't use simple_strtol() anymore
audit: initialize the audit subsystem as early as possible
audit: ensure that 'audit=1' actually enables audit for PID 1
37 lines
500 B
C
37 lines
500 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifdef __NR_rename
|
|
__NR_rename,
|
|
#endif
|
|
#ifdef __NR_mkdir
|
|
__NR_mkdir,
|
|
#endif
|
|
#ifdef __NR_rmdir
|
|
__NR_rmdir,
|
|
#endif
|
|
#ifdef __NR_creat
|
|
__NR_creat,
|
|
#endif
|
|
#ifdef __NR_link
|
|
__NR_link,
|
|
#endif
|
|
#ifdef __NR_unlink
|
|
__NR_unlink,
|
|
#endif
|
|
#ifdef __NR_symlink
|
|
__NR_symlink,
|
|
#endif
|
|
#ifdef __NR_mknod
|
|
__NR_mknod,
|
|
#endif
|
|
#ifdef __NR_mkdirat
|
|
__NR_mkdirat,
|
|
__NR_mknodat,
|
|
__NR_unlinkat,
|
|
__NR_renameat,
|
|
__NR_linkat,
|
|
__NR_symlinkat,
|
|
#endif
|
|
#ifdef __NR_renameat2
|
|
__NR_renameat2,
|
|
#endif
|