Searched hist:a1aa08a0 (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/security/integrity/evm/ |
H A D | evm_secfs.c | a1aa08a0 Tue Mar 26 13:49:20 CDT 2019 Richard Guy Briggs <rgb@redhat.com> audit: link integrity evm_write_xattrs record to syscall event
In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs"), the call to audit_log_start() is missing a context to link it to an audit event. Since this event is in user context, add the process' syscall context to the record.
In addition, the orphaned keyword "locked" appears in the record. Normalize this by changing it to logging the locking string "." as any other user input in the "xattr=" field.
Please see the github issue https://github.com/linux-audit/audit-kernel/issues/109
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com> a1aa08a0 Tue Mar 26 13:49:20 CDT 2019 Richard Guy Briggs <rgb@redhat.com> audit: link integrity evm_write_xattrs record to syscall event In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs"), the call to audit_log_start() is missing a context to link it to an audit event. Since this event is in user context, add the process' syscall context to the record. In addition, the orphaned keyword "locked" appears in the record. Normalize this by changing it to logging the locking string "." as any other user input in the "xattr=" field. Please see the github issue https://github.com/linux-audit/audit-kernel/issues/109 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
|