Steve Grubb
f9b741d300
UPSTREAM: audit: Record fanotify access control decisions ...
The fanotify interface allows user space daemons to make access
control decisions. Under common criteria requirements, we need to
optionally record decisions based on policy. This patch adds a bit mask,
FAN_AUDIT, that a user space daemon can 'or' into the response decision
which will tell the kernel that it made a decision and record it.
It would be used something like this in user space code:
response.response = FAN_DENY | FAN_AUDIT;
write(fd, &response, sizeof(struct fanotify_response));
When the syscall ends, the audit system will record the decision as a
AUDIT_FANOTIFY auxiliary record to denote that the reason this event
occurred is the result of an access control decision from fanotify
rather than DAC or MAC policy.
A sample event looks like this:
type=PATH msg=audit(1504310584.332:290): item=0 name="./evil-ls"
inode=1319561 dev=fc:03 mode=0100755 ouid=1000 ogid=1000 rdev=00:00
obj=unconfined_u:object_r:user_home_t:s0 nametype=NORMAL
type=CWD msg=audit(1504310584.332:290): cwd="/home/sgrubb"
type=SYSCALL msg=audit(1504310584.332:290): arch=c000003e syscall=2
success=no exit=-1 a0=32cb3fca90 a1=0 a2=43 a3=8 items=1 ppid=901
pid=959 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=3 comm="bash"
exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:
s0-s0:c0.c1023 key=(null)
type=FANOTIFY msg=audit(1504310584.332:290): resp=2
Prior to using the audit flag, the developer needs to call
fanotify_init or'ing in FAN_ENABLE_AUDIT to ensure that the kernel
supports auditing. The calling process must also have the CAP_AUDIT_WRITE
capability.
Signed-off-by: sgrubb <sgrubb@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
2026-05-15 17:59:18 +07:00
UPSTREAM: bpf: Fix build in minimal configurations, again
2026-05-15 17:59:17 +07:00
BACKPORT: kernfs: allow creating kernfs objects with arbitrary uid/gid
2026-05-15 17:59:10 +07:00
UPSTREAM: kdb: use correct pointer when 'btc' calls 'btt'
2022-02-21 16:30:05 +01:00
BACKPORT: bpf: Convert bpf_prog refcnt to atomic64_t
2026-05-15 17:59:15 +07:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20
2023-01-19 15:42:12 +01:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-07-18 14:05:31 +03:00
UPSTREAM: locking/lockdep: Add new check to lock_downgrade()
2026-05-15 17:57:11 +07:00
treewide: Backport new vmalloc for large performance benefits
2026-05-15 17:48:25 +07:00
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
rcu: Fix self-wakeups for grace-period kthread
2026-05-15 17:49:36 +07:00
UPSTREAM: timers: Omit POSIX timer stuff from task_struct when disabled
2026-05-15 17:59:01 +07:00
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
acct: fix potential integer overflow in encode_comp_t()
2023-01-07 12:07:31 +01:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
2021-04-26 01:27:02 +03:00
UPSTREAM: audit: log module name on init_module
2026-05-15 17:59:18 +07:00
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 20:40:07 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2021-04-07 12:05:41 +02:00
UPSTREAM: audit: Record fanotify access control decisions
2026-05-15 17:59:18 +07:00
UPSTREAM: posix-timers: Make them configurable
2026-05-15 17:59:01 +07:00
rcu: Migrate callbacks earlier in the CPU-offline timeline
2026-05-15 17:49:31 +07:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into HEAD
2020-06-30 02:33:58 +03:00
memcg: account security cred as well to kmemcg
2020-01-12 11:24:13 +01:00
UPSTREAM: signal: Pass pid type into group_send_sig_info
2026-05-15 17:59:02 +07:00
BACKPORT: bpf: Add support for BTF pointers to x86 JIT
2026-05-15 17:58:58 +07:00
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-07-11 12:46:40 +02:00
treewide: Backport new vmalloc for large performance benefits
2026-05-15 17:48:25 +07:00
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
jump_label: Disable jump labels in __exit code
2021-06-06 18:42:18 +03:00
BACKPORT: symbol lookup: introduce dereference_symbol_descriptor()
2026-05-15 17:57:02 +07:00
BACKPORT: bpf: introduce bpf_spin_lock
2026-05-15 17:57:29 +07:00
BACKPORT: mm: split page_type out from _mapcount
2026-05-15 17:57:58 +07:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-07-18 14:05:31 +03:00
BACKPORT: kmod: split out umh code into its own file
2026-05-15 17:56:31 +07:00
UPSTREAM: kprobes: Show blacklist addresses as same as kallsyms does
2026-05-15 17:57:02 +07:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
2021-07-22 02:11:11 +03:00
BACKPORT: kmod: split out umh code into its own file
2026-05-15 17:56:31 +07:00
UPSTREAM: audit: log module name on init_module
2026-05-15 17:59:18 +07:00
x86/mm: split vmalloc_sync_all()
2020-04-02 17:20:26 +02:00
UPSTREAM: perf: Add PERF_RECORD_NAMESPACES to include namespaces related info
2026-05-15 17:58:54 +07:00
padata: purge get_cpu and reorder_via_wq from padata_do_serial
2020-05-27 16:41:53 +02:00
BACKPORT: locking/refcount: Create unchecked atomic_t implementation
2026-05-15 17:54:59 +07:00
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 11:43:08 +02:00
profiling: fix shift-out-of-bounds bugs
2021-09-26 13:36:18 +02:00
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 16:52:28 +02:00
reboot: fix overflow parsing reboot cpu number
2020-11-18 18:26:32 +01:00
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:29:03 +02:00
UPSTREAM: seccomp, bpf: disable preemption before calling into bpf prog
2026-05-15 17:58:54 +07:00
UPSTREAM: signal: Pass pid type into group_send_sig_info
2026-05-15 17:59:02 +07:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-06-12 01:39:01 +03:00
UPSTREAM: posix-timers: Make them configurable
2026-05-15 17:59:01 +07:00
BACKPORT: sysctl: define proc_do_static_key()
2026-05-15 17:57:55 +07:00
taskstats: fix data-race
2020-01-12 11:24:12 +01:00
BACKPORT: tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2026-05-15 17:57:41 +07:00
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:56:40 +01:00
BACKPORT: umh: add exit routine for UMH process
2026-05-15 17:58:52 +07:00
rcu: Create RCU-specific workqueues with rescuers
2026-05-15 17:49:31 +07:00
f9b741d300