Re: [PATCH v2] audit: handle unknown status requests in audit_receive_msg

[Paul Moore]

On Mar  9, 2026 Ricardo Robaina <rrobaina@xxxxxxxxxx> wrote:
> 
> Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET
> requests, incorrectly returning success to newer user space tools
> querying unsupported features. This breaks forward compatibility.
> 
> Fix this by defining AUDIT_STATUS_ALL and returning -EINVAL if any
> unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL).
> This ensures invalid requests are safely rejected, allowing user space
> to reliably test for and gracefully handle feature detection on older
> kernels.
> 
> Suggested-by: Steve Grubb <sgrubb@xxxxxxxxxx>
> Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> ---
> v1 -> v2:
>  - Moved AUDIT_STATUS_ALL from include/uapi/linux/audit.h to 
>    include/linux/audit.h.
> 
>  include/linux/audit.h | 9 +++++++++
>  kernel/audit.c        | 2 ++
>  2 files changed, 11 insertions(+)

Merged into audit/dev, thanks.

--
paul-moore.com