netfilter: nf_tables: Deduplicate nft_register_obj audit logs
authorPhil Sutter <phil@nwl.cc>
Sat, 23 Sep 2023 01:53:50 +0000 (03:53 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 10 Oct 2023 20:00:43 +0000 (22:00 +0200)
commit7ff9a9857b8b5197e0ced9bb37256decfc59b95b
tree7ea99935d1e238c04a62347eaeb0be6830cb8509
parente1bbe4afe1a38e679d8704ec16c11e542ad9acc4
netfilter: nf_tables: Deduplicate nft_register_obj audit logs

[ Upstream commit 0d880dc6f032e0b541520e9926f398a77d3d433c ]

When adding/updating an object, the transaction handler emits suitable
audit log entries already, the one in nft_obj_notify() is redundant. To
fix that (and retain the audit logging from objects' 'update' callback),
Introduce an "audit log free" variant for internal use.

Fixes: c520292f29b8 ("audit: log nftables configuration change events once per table")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_tables_api.c
tools/testing/selftests/netfilter/nft_audit.sh