Re: [PATCH v3] audit: Report suspicious O_CREAT usage

From: Paul Moore
Date: Thu Oct 03 2019 - 14:29:30 EST


On Wed, Oct 2, 2019 at 7:42 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> This renames the very specific audit_log_link_denied() to
> audit_log_path_denied() and adds the AUDIT_* type as an argument. This
> allows for the creation of the new AUDIT_ANOM_CREAT that can be used to
> report the fifo/regular file creation restrictions that were introduced
> in commit 30aba6656f61 ("namei: allow restricted O_CREAT of FIFOs and
> regular files").
>
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> ---
> v3:
> - retain existing operation names (paul)
> v2:
> - fix build failure typo in CONFIG_AUDIT=n case
> - improve operations naming (paul)
> ---
> fs/namei.c | 8 ++++++--
> include/linux/audit.h | 5 +++--
> include/uapi/linux/audit.h | 1 +
> kernel/audit.c | 11 ++++++-----
> 4 files changed, 16 insertions(+), 9 deletions(-)

Merged into audit/next - thanks!

--
paul moore
www.paul-moore.com