archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:04:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

audit: add record for multiple object contexts

Browse source 
Create a new audit record AUDIT_MAC_OBJ_CONTEXTS.
An example of the MAC_OBJ_CONTEXTS record is:

    type=MAC_OBJ_CONTEXTS
      msg=audit(1601152467.009:1050):
      obj_selinux=unconfined_u:object_r:user_home_t:s0

When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record
the "obj=" field in other records in the event will be "obj=?".
An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has
multiple security modules that may make access decisions based
on an object security context.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subj tweak, audit example readability indents]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2025-08-16 10:28:59 -07:00 • committed by Paul Moore
parent eb59d494ee
commit 0ffbc876d0
6 changed files with 78 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

4
security/selinux/hooks.c
View file

@ -7619,7 +7619,9 @@ static __init int selinux_init(void)
cred_init_security();
/* Inform the audit system that secctx is used */
audit_cfg_lsm(&selinux_lsmid, AUDIT_CFG_LSM_SECCTX_SUBJECT);
audit_cfg_lsm(&selinux_lsmid,
AUDIT_CFG_LSM_SECCTX_SUBJECT |
AUDIT_CFG_LSM_SECCTX_OBJECT);
default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
if (!default_noexec)

4
security/smack/smack_lsm.c
View file

@ -5268,7 +5268,9 @@ static __init int smack_init(void)
init_smack_known_list();
/* Inform the audit system that secctx is used */
audit_cfg_lsm(&smack_lsmid, AUDIT_CFG_LSM_SECCTX_SUBJECT);
audit_cfg_lsm(&smack_lsmid,
AUDIT_CFG_LSM_SECCTX_SUBJECT |
AUDIT_CFG_LSM_SECCTX_OBJECT);
return 0;
}