Amy Griffis 9c937dcc71 [PATCH] log more info for directory entry change events ...

When an audit event involves changes to a directory entry, include
a PATH record for the directory itself.  A few other notable changes:

    - fixed audit_inode_child() hooks in fsnotify_move()
    - removed unused flags arg from audit_inode()
    - added audit log routines for logging a portion of a string

Here's some sample output.

before patch:
type=SYSCALL msg=audit(1149821605.320:26): arch=40000003 syscall=39 success=yes exit=0 a0=bf8d3c7c a1=1ff a2=804e1b8 a3=bf8d3c7c items=1 ppid=739 pid=800 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149821605.320:26):  cwd="/root"
type=PATH msg=audit(1149821605.320:26): item=0 name="foo" parent=164068 inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

after patch:
type=SYSCALL msg=audit(1149822032.332:24): arch=40000003 syscall=39 success=yes exit=0 a0=bfdd9c7c a1=1ff a2=804e1b8 a3=bfdd9c7c items=2 ppid=714 pid=777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149822032.332:24):  cwd="/root"
type=PATH msg=audit(1149822032.332:24): item=0 name="/root" inode=164068 dev=03:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_dir_t:s0
type=PATH msg=audit(1149822032.332:24): item=1 name="foo" inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2006-06-20 05:25:28 -04:00

..

9p

[PATCH] v9fs: signal handling fixes

2006-05-15 11:20:56 -07:00

adfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

affs

[PATCH] affs: possible null pointer dereference in affs_rename()

2006-05-26 11:55:46 -07:00

afs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

autofs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

autofs4

[PATCH] autofs4: NFY_NONE wait race fix

2006-05-15 11:20:54 -07:00

befs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

bfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

cifs

[[CIFS] Pass truncate open flag through on file open in case setattr fails

2006-05-30 18:09:31 +00:00

coda

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

configfs

configfs: configfs_mkdir() failed to cleanup linkage.

2006-05-17 14:38:51 -07:00

cramfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

debugfs

[PATCH] debugfs inode leak

2006-06-08 15:14:24 -07:00

devfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

devpts

[PATCH] devpts: use lib/parser.c for parsing mount options

2006-03-23 07:38:17 -08:00

efs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

exportfs

[PATCH] NFS server subtree_check returns dubious value

2006-05-21 12:59:16 -07:00

ext2

[PATCH] Introduce sys_splice() system call

2006-03-30 12:28:18 -08:00

ext3

[PATCH] ext3 resize: fix double unlock_super()

2006-05-31 16:27:10 -07:00

fat

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

freevxfs

BUG_ON() Conversion in fs/freevxfs/

2006-04-02 13:41:02 +02:00

fuse

[fuse] fix race between checking and setting file->private_data

2006-04-26 10:49:16 +02:00

hfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

hfsplus

BUG_ON() Conversion in fs/hfsplus/

2006-04-01 01:14:43 +02:00

hostfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

hpfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

hppfs

[PATCH] uml: __user annotations

2006-03-31 12:18:51 -08:00

hugetlbfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

isofs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

jbd

[PATCH] Make address_space_operations->invalidatepage return void

2006-03-26 08:56:55 -08:00

jffs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

jffs2

[PATCH] jffs2 warning fixes

2006-05-15 11:20:58 -07:00

jfs

JFS: Fix multiple errors in metapage_releasepage

2006-05-24 07:43:38 -05:00

lockd

NFS: make 2 functions static

2006-04-19 12:43:47 -04:00

minix

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

msdos

[PATCH] fat: kill reserved names

2006-03-31 12:18:55 -08:00

ncpfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

nfs

NFS: remove needless check in nfs_opendir()

2006-04-19 13:06:37 -04:00

nfs_common

[PATCH] nfsacl: Solaris VxFS compatibility fix

2005-10-11 09:46:54 -07:00

nfsd

[PATCH] knfsd: Fix two problems that can cause rmmod nfsd to die

2006-05-23 10:35:31 -07:00

nls

[PATCH] fs: Use ARRAY_SIZE macro

2006-03-24 07:33:19 -08:00

ntfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

ocfs2

ocfs2: fix gfp mask in some file system paths

2006-05-17 14:38:49 -07:00

openpromfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

partitions

Alternative fix for MMC oops on unmount after removal

2006-05-12 18:42:09 -07:00

proc

[PATCH] proc_loginuid_write() uses simple_strtoul() on non-terminated array

2006-06-20 05:25:24 -04:00

qnx4

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

ramfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

reiserfs

[PATCH] Fix reiserfs deadlock

2006-04-22 09:19:53 -07:00

romfs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

smbfs

[PATCH] smbfs: Fix slab corruption in samba error path

2006-05-15 11:20:56 -07:00

sysfs

[PATCH] sysfs: Allow sysfs attribute files to be pollable

2006-04-14 11:41:24 -07:00

sysv

BUG_ON() Conversion in fs/sysv/

2006-04-02 13:39:21 +02:00

udf

BUG_ON() Conversion in fs/udf/

2006-04-02 13:40:13 +02:00

ufs

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

vfat

[PATCH] fat: kill reserved names

2006-03-31 12:18:55 -08:00

xfs

[XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an

2006-05-08 19:51:58 +10:00

aio.c

[PATCH] use kzalloc and kcalloc in core fs code

2006-03-25 08:23:00 -08:00

attr.c

[PATCH] capable/capability.h (fs/)

2006-01-11 18:42:13 -08:00

bad_inode.c

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

binfmt_aout.c

[PATCH] dump_thread() cleanup

2006-01-10 08:01:25 -08:00

binfmt_elf_fdpic.c

BUG_ON() Conversion in fs/binfmt_elf_fdpic.c

2006-03-24 18:38:48 +01:00

binfmt_elf.c

[PATCH] x86_64: Increase the variability of the process stack on 64bit architectures

2006-03-25 09:10:52 -08:00

binfmt_em86.c

…

binfmt_flat.c

[PATCH] binfmt_flat: don't check for EMFILE

2006-05-21 12:59:17 -07:00

binfmt_misc.c

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

binfmt_script.c

…

binfmt_som.c

[PATCH] mm: mm_init set_mm_counters

2005-10-29 21:40:38 -07:00

bio.c

[PATCH] Fix missing ret assignment in __bio_map_user() error path

2006-06-17 10:52:12 -07:00

block_dev.c

[PATCH] Add ->splice_read/splice_write to def_blk_fops

2006-05-01 19:59:32 +02:00

buffer.c

[PATCH] for_each_online_pgdat: renaming for_each_pgdat

2006-03-27 08:44:48 -08:00

char_dev.c

[PATCH] Simplify proc/devices and fix early termination regression

2006-03-31 12:18:53 -08:00

compat_ioctl.c

[PATCH] fs: Use ARRAY_SIZE macro

2006-03-24 07:33:19 -08:00

compat.c

[PATCH] NFS: fix error handling on access_ok in compat_sys_nfsservctl

2006-05-21 12:59:16 -07:00

dcache.c

[PATCH] dcache: Add helper d_hash_and_lookup

2006-03-31 12:19:00 -08:00

dcookies.c

[PATCH] Use __read_mostly on some hot fs variables

2006-03-26 08:56:56 -08:00

direct-io.c

BUG_ON() Conversion in fs/direct-io.c

2006-04-01 01:10:13 +02:00

dnotify.c

[PATCH] Use __read_mostly on some hot fs variables

2006-03-26 08:56:56 -08:00

dquot.c

BUG_ON() Conversion in fs/dquot.c

2006-04-02 13:36:13 +02:00

drop_caches.c

[PATCH] drop-pagecache

2006-01-08 20:12:40 -08:00

eventpoll.c

[PATCH] uniform POLLRDHUP handling between epoll and poll/select

2006-04-11 06:18:42 -07:00

exec.c

[PATCH] execve argument logging

2006-06-20 05:25:21 -04:00

fcntl.c

BUG_ON() Conversion in fs/fcntl.c

2006-04-02 13:37:19 +02:00

fifo.c

[PATCH] pipe.c/fifo.c code cleanups

2006-04-11 13:53:33 +02:00

file_table.c

[PATCH] get_empty_filp tweaks, inline epoll_init_file()

2006-03-23 07:38:17 -08:00

file.c

[PATCH] for_each_possible_cpu: fixes for generic part

2006-03-28 09:16:05 -08:00

filesystems.c

[PATCH] fix missing includes

2005-10-30 17:37:32 -08:00

fs-writeback.c

[PATCH] Move cond_resched() after iput() in sync_sb_inodes()

2006-03-25 08:22:56 -08:00

inode.c

BUG_ON() Conversion in fs/inode.c

2006-04-02 13:38:18 +02:00

inotify_user.c

[PATCH] inotify (3/5): add interfaces to kernel API

2006-06-20 05:25:18 -04:00

inotify.c

[PATCH] inotify (4/5): allow watch removal from event handler

2006-06-20 05:25:19 -04:00

ioctl.c

[PATCH] capable/capability.h (fs/)

2006-01-11 18:42:13 -08:00

ioprio.c

[PATCH] capable/capability.h (fs/)

2006-01-11 18:42:13 -08:00

Kconfig

[PATCH] inotify (1/5): split kernel API from userspace support

2006-06-20 05:25:17 -04:00

Kconfig.binfmt

[PATCH] frv: suppress configuration of certain features for FRV

2006-01-08 20:13:36 -08:00

libfs.c

[PATCH] Make most file operations structs in fs/ const

2006-03-28 09:16:06 -08:00

locks.c

[PATCH] Return error in case flock_lock_file failure

2006-06-14 08:59:44 -07:00

Makefile

[PATCH] inotify (1/5): split kernel API from userspace support

2006-06-20 05:25:17 -04:00

mbcache.c

[PATCH] Typo fixes

2006-03-28 09:16:08 -08:00

mpage.c

[PATCH] map multiple blocks for mpage_readpages()

2006-03-26 08:57:01 -08:00

namei.c

[PATCH] log more info for directory entry change events

2006-06-20 05:25:28 -04:00

namespace.c

[PATCH] revert "vfs: propagate mnt_flags into do_loopback/vfsmount"

2006-05-15 11:20:57 -07:00

nfsctl.c

[PATCH] fs: Use ARRAY_SIZE macro

2006-03-24 07:33:19 -08:00

open.c

[PATCH] log more info for directory entry change events

2006-06-20 05:25:28 -04:00

pipe.c

[PATCH] vmsplice: restrict stealing a little more

2006-05-02 15:29:57 +02:00

pnode.c

[PATCH] s/;;/;/g

2006-03-24 07:33:24 -08:00

pnode.h

[PATCH] unbindable mounts

2005-11-07 18:18:11 -08:00

posix_acl.c

[PATCH] gfp flags annotations - part 1

2005-10-08 15:00:57 -07:00

quota_v1.c

…

quota_v2.c

[PATCH] sem2mutex: quota

2006-03-23 07:38:11 -08:00

quota.c

[PATCH] sem2mutex: quota

2006-03-23 07:38:11 -08:00

read_write.c

[PATCH] splice: unlikely() optimizations

2006-04-11 13:56:09 +02:00

readdir.c

[PATCH] mutex subsystem, semaphore to mutex: VFS, ->i_sem

2006-01-09 15:59:24 -08:00

select.c

[PATCH] select: don't overflow if (SELECT_STACK_ALLOC % sizeof(long) != 0)

2006-04-11 06:18:41 -07:00

seq_file.c

[PATCH] sem2mutex: fs/seq_file.c

2006-03-23 07:38:12 -08:00

splice.c

[PATCH] splice: redo page lookup if add_to_page_cache() returns -EEXIST

2006-05-04 06:55:12 +02:00

stat.c

[PATCH] powerpc: Wire up *at syscalls

2006-04-28 21:04:59 +10:00

super.c

[PATCH] sem2mutex: fs/

2006-03-26 08:56:55 -08:00

sync.c

[PATCH] sync_file_range(): use unsigned for flags

2006-04-11 06:18:40 -07:00

xattr_acl.c

…

xattr.c

[PATCH] log more info for directory entry change events

2006-06-20 05:25:28 -04:00