6e66ec3cae
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2. Signed-off-by: Steve Grubb <sgrubb@redhat.com> Reviewed-by: Richard Guy Briggs <rgb@redhat.com> [PM: cleaned up some whitespace errors] Signed-off-by: Paul Moore <paul@paul-moore.com>
36 lines
461 B
C
36 lines
461 B
C
#ifdef __NR_rename
|
|
__NR_rename,
|
|
#endif
|
|
#ifdef __NR_mkdir
|
|
__NR_mkdir,
|
|
#endif
|
|
#ifdef __NR_rmdir
|
|
__NR_rmdir,
|
|
#endif
|
|
#ifdef __NR_creat
|
|
__NR_creat,
|
|
#endif
|
|
#ifdef __NR_link
|
|
__NR_link,
|
|
#endif
|
|
#ifdef __NR_unlink
|
|
__NR_unlink,
|
|
#endif
|
|
#ifdef __NR_symlink
|
|
__NR_symlink,
|
|
#endif
|
|
#ifdef __NR_mknod
|
|
__NR_mknod,
|
|
#endif
|
|
#ifdef __NR_mkdirat
|
|
__NR_mkdirat,
|
|
__NR_mknodat,
|
|
__NR_unlinkat,
|
|
__NR_renameat,
|
|
__NR_linkat,
|
|
__NR_symlinkat,
|
|
#endif
|
|
#ifdef __NR_renameat2
|
|
__NR_renameat2,
|
|
#endif
|