[PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
to be used only in kernel/auditfilter.c to increment the audit_signals
counter.

This counter is used to determine if information related to a target
process of a syscall audit rule using signals, such as its pid,
should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).

Information related to signals sent via these system calls are
currently not correctly logged. The current patch adds it to the
AUDIT_CLASS_SIGNAL* class.

Signed-off-by: Jeffrey Bencteux <jeff@xxxxxxxxxxx>
---
 include/asm-generic/audit_signal.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/asm-generic/audit_signal.h b/include/asm-generic/audit_signal.h
index 6feab7f18a53..65336a9aef7b 100644
--- a/include/asm-generic/audit_signal.h
+++ b/include/asm-generic/audit_signal.h
@@ -1,3 +1,12 @@
 __NR_kill,
 __NR_tgkill,
 __NR_tkill,
+#ifdef __NR_rt_sigqueueinfo
+__NR_rt_sigqueueinfo,
+#endif
+#ifdef __NR_rt_tgsigqueueinfo
+__NR_rt_tgsigqueueinfo,
+#endif
+#ifdef __NR_pidfd_send_signal
+__NR_pidfd_send_signal,
+#endif

base-commit: 6614d4c05c7a661a925b3d8dbf9c70faac3bd2da
-- 
2.56.0