netfilter: create audit records for x_tables replaces (fbabf31e) · Commits · 戴 / test

include/linux/audit.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -104,6 +104,7 @@
		#define AUDIT_CAPSET 1322 /* Record showing argument to sys_capset */
		#define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */
		#define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */
		#define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */

		#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
		#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */

+16 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@
		#include <linux/mutex.h>
		#include <linux/mm.h>
		#include <linux/slab.h>
		#include <linux/audit.h>
		#include <net/net_namespace.h>

		#include <linux/netfilter/x_tables.h>
		@@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table,
		*/
		local_bh_enable();

		#ifdef CONFIG_AUDIT
		if (audit_enabled) {
		struct audit_buffer *ab;

		ab = audit_log_start(current->audit_context, GFP_KERNEL,
		AUDIT_NETFILTER_CFG);
		if (ab) {
		audit_log_format(ab, "table=%s family=%u entries=%u",
		table->name, table->af,
		private->number);
		audit_log_end(ab);
		}
		}
		#endif

		return private;
		}
		EXPORT_SYMBOL_GPL(xt_replace_table);