Commit d904ac03 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore
Browse files

audit: rename FILTER_TYPE to FILTER_EXCLUDE 

The AUDIT_FILTER_TYPE name is vague and misleading due to not describing
where or when the filter is applied and obsolete due to its available
filter fields having been expanded.

Userspace has already renamed it from AUDIT_FILTER_TYPE to
AUDIT_FILTER_EXCLUDE without checking if it already exists.  The
userspace maintainer assures that as long as it is set to the same value
it will not be a problem since the userspace code does not treat
compiler warnings as errors.  If this policy changes then checks if it
already exists can be added at the same time.

See: https://github.com/linux-audit/audit-kernel/issues/89



Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent af85d177

include/uapi/linux/audit.h

+2 −1
Original line number Diff line number Diff line
@@ -157,7 +157,8 @@ 
#define AUDIT_FILTER_ENTRY	0x02	/* Apply rule at syscall entry */

#define AUDIT_FILTER_WATCH	0x03	/* Apply rule to file system watches */

#define AUDIT_FILTER_EXIT	0x04	/* Apply rule at syscall exit */

#define AUDIT_FILTER_TYPE	0x05	/* Apply rule at audit_log_start */

#define AUDIT_FILTER_EXCLUDE	0x05	/* Apply rule before record creation */

#define AUDIT_FILTER_TYPE	AUDIT_FILTER_EXCLUDE /* obsolete misleading naming */

#define AUDIT_FILTER_FS		0x06	/* Apply rule at __audit_inode_child */



#define AUDIT_NR_FILTERS	7

kernel/audit.c

+1 −1
Original line number Diff line number Diff line
@@ -1754,7 +1754,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 
	if (audit_initialized != AUDIT_INITIALIZED)

		return NULL;



	if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE)))

	if (unlikely(!audit_filter(type, AUDIT_FILTER_EXCLUDE)))

		return NULL;



	/* NOTE: don't ever fail/sleep on these two conditions:

kernel/auditfilter.c

+5 −5
Original line number Diff line number Diff line
@@ -264,7 +264,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data * 
	case AUDIT_FILTER_TASK:

#endif

	case AUDIT_FILTER_USER:

	case AUDIT_FILTER_TYPE:

	case AUDIT_FILTER_EXCLUDE:

	case AUDIT_FILTER_FS:

		;

	}
@@ -337,7 +337,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 
{

	switch(f->type) {

	case AUDIT_MSGTYPE:

		if (entry->rule.listnr != AUDIT_FILTER_TYPE &&

		if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&

		    entry->rule.listnr != AUDIT_FILTER_USER)

			return -EINVAL;

		break;
@@ -929,7 +929,7 @@ static inline int audit_add_rule(struct audit_entry *entry) 
	/* If any of these, don't count towards total */

	switch(entry->rule.listnr) {

	case AUDIT_FILTER_USER:

	case AUDIT_FILTER_TYPE:

	case AUDIT_FILTER_EXCLUDE:

	case AUDIT_FILTER_FS:

		dont_count = 1;

	}
@@ -1011,7 +1011,7 @@ int audit_del_rule(struct audit_entry *entry) 
	/* If any of these, don't count towards total */

	switch(entry->rule.listnr) {

	case AUDIT_FILTER_USER:

	case AUDIT_FILTER_TYPE:

	case AUDIT_FILTER_EXCLUDE:

	case AUDIT_FILTER_FS:

		dont_count = 1;

	}
@@ -1372,7 +1372,7 @@ int audit_filter(int msgtype, unsigned int listtype) 
				break;

		}

		if (result > 0) {

			if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_TYPE)

			if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)

				ret = 0;

			break;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE