• Mr Dash Four's avatar
    netfilter: add SELinux context support to AUDIT target · 131ad62d
    Mr Dash Four authored
    In this revision the conversion of secid to SELinux context and adding it
    to the audit log is moved from xt_AUDIT.c to audit.c with the aid of a
    separate helper function - audit_log_secctx - which does both the conversion
    and logging of SELinux context, thus also preventing internal secid number
    being leaked to userspace. If conversion is not successful an error is raised.
    With the introduction of this helper function the work done in xt_AUDIT.c is
    much more simplified. It also opens the possibility of this helper function
    being used by other modules (including auditd itself), if desired. With this
    addition, typical (raw auditd) output after applying the patch would be:
    type=NETFILTER_PKT msg=audit(1305852240.082:31012): action=0 hook=1 len=52 inif=? outif=eth0 saddr= daddr= ipid=16312 proto=6 sport=56150 dport=22 obj=system_u:object_r:ssh_client_packet_t:s0
    type=NETFILTER_PKT msg=audit(1306772064.079:56): action=0 hook=3 len=48 inif=eth0 outif=? smac=00:05:5d:7c:27:0b dmac=00:02:b3:0a:7f:81 macproto=0x0800 saddr= daddr= ipid=462 proto=6 sport=22 dport=3561 obj=system_u:object_r:ssh_server_packet_t:s0
    Acked-by: default avatarEric Paris <eparis@redhat.com>
    Signed-off-by: default avatarMr Dash Four <mr.dash.four@googlemail.com>
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
audit.h 24.1 KB