path: root/security/selinux/ss
diff options
authorRichard Guy Briggs <rgb@redhat.com>2018-04-09 19:34:22 -0400
committerPaul Moore <paul@paul-moore.com>2018-04-17 17:40:40 -0400
commit4195ed425d3c77f4cf11f3511feeb723a8f48587 (patch)
treeedaae5ca81af1b9936e95059ff80e8fe86aacf39 /security/selinux/ss
parentsecurity: selinux: Change return type to vm_fault_t (diff)
audit: normalize MAC_STATUS record
There were two formats of the audit MAC_STATUS record, one of which was more standard than the other. One listed enforcing status changes and the other listed enabled status changes with a non-standard label. In addition, the record was missing information about which LSM was responsible and the operation's completion status. While this record is only issued on success, the parser expects the res= field to be present. old enforcing/permissive: type=MAC_STATUS msg=audit(1523312831.378:24514): enforcing=0 old_enforcing=1 auid=0 ses=1 old enable/disable: type=MAC_STATUS msg=audit(1523312831.378:24514): selinux=0 auid=0 ses=1 List both sets of status and old values and add the lsm= field and the res= field. Here is the new format: type=MAC_STATUS msg=audit(1523293828.657:891): enforcing=0 old_enforcing=1 auid=0 ses=1 enabled=1 old-enabled=1 lsm=selinux res=1 This record already accompanied a SYSCALL record. See: https://github.com/linux-audit/audit-kernel/issues/46 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> [PM: 80-char fixes, merge fuzz, use new SELinux state functions] Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/ss')
0 files changed, 0 insertions, 0 deletions