f9bab2677a
Pull audit updates from Paul Moore:
"Another relatively small pull request for audit, nine patches total.
The only real new bit of functionality is the patch from Richard which
adds the ability to filter records based on the filesystem type.
The remainder are bug fixes and cleanups; the bug fix highlights
include:
- ensuring that we properly audit init/PID-1 (me)
- allowing the audit daemon to shutdown the kernel/auditd connection
cleanly by setting the audit PID to zero (Steve)"
* tag 'audit-pr-20171113' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: filter PATH records keyed on filesystem magic
Audit: remove unused audit_log_secctx function
audit: Allow auditd to set pid to 0 to end auditing
audit: Add new syscalls to the perm=w filter
audit: use audit_set_enabled() in audit_enable()
audit: convert audit_ever_enabled to a boolean
audit: don't use simple_strtol() anymore
audit: initialize the audit subsystem as early as possible
audit: ensure that 'audit=1' actually enables audit for PID 1
26 lines
461 B
C
26 lines
461 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#include <asm-generic/audit_dir_write.h>
|
|
__NR_acct,
|
|
#ifdef __NR_swapon
|
|
__NR_swapon,
|
|
#endif
|
|
__NR_quotactl,
|
|
#ifdef __NR_truncate
|
|
__NR_truncate,
|
|
#endif
|
|
#ifdef __NR_truncate64
|
|
__NR_truncate64,
|
|
#endif
|
|
#ifdef __NR_ftruncate
|
|
__NR_ftruncate,
|
|
#endif
|
|
#ifdef __NR_ftruncate64
|
|
__NR_ftruncate64,
|
|
#endif
|
|
#ifdef __NR_bind
|
|
__NR_bind, /* bind can affect fs object only in one way... */
|
|
#endif
|
|
#ifdef __NR_fallocate
|
|
__NR_fallocate,
|
|
#endif
|