audit: allow audit matching on inode gid
authorEric Paris <eparis@redhat.com>
Tue, 3 Jan 2012 19:23:07 +0000 (14:23 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 17 Jan 2012 21:16:59 +0000 (16:16 -0500)
Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris <eparis@redhat.com>
include/linux/audit.h
kernel/auditfilter.c
kernel/auditsc.c

index 55cb3daaf474172192ab85ec55daf08a9e6004bc..e36aa37c88af8c9aa0ff42743d7a84ba7a4bf590 100644 (file)
 #define AUDIT_DIR      107
 #define AUDIT_FILETYPE 108
 #define AUDIT_OBJ_UID  109
+#define AUDIT_OBJ_GID  110
 
 #define AUDIT_ARG0      200
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
index 13e997423dcd85d43af5741098b51a8f70fce4cb..f10605c787e6817422ed7a0a045401b8b232d855 100644 (file)
@@ -462,6 +462,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                case AUDIT_ARG2:
                case AUDIT_ARG3:
                case AUDIT_OBJ_UID:
+               case AUDIT_OBJ_GID:
                        break;
                case AUDIT_ARCH:
                        entry->rule.arch_f = f;
index 5cf3ecc015176162481d13b257c3efc603c5a7a6..87b375fb12ffd6d71dadbc8598d53852f109f4c0 100644 (file)
@@ -598,6 +598,18 @@ static int audit_filter_rules(struct task_struct *tsk,
                                }
                        }
                        break;
+               case AUDIT_OBJ_GID:
+                       if (name) {
+                               result = audit_comparator(name->gid, f->op, f->val);
+                       } else if (ctx) {
+                               list_for_each_entry(n, &ctx->names_list, list) {
+                                       if (audit_comparator(n->gid, f->op, f->val)) {
+                                               ++result;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
                case AUDIT_WATCH:
                        if (name)
                                result = audit_watch_compare(rule->watch, name->ino, name->dev);