audit: fix event coverage of AUDIT_ANOM_LINK
authorEric Paris <eparis@redhat.com>
Tue, 30 Apr 2013 19:30:32 +0000 (15:30 -0400)
committerEric Paris <eparis@redhat.com>
Tue, 30 Apr 2013 19:31:28 +0000 (15:31 -0400)
commitb24a30a7305418ff138ff51776fc555ec57c011a
tree2c64cff75b758c3fb407118ab473167fb5bec3fa
parent7173c54e3a9deb491a586e7e107375109ee48bcb
audit: fix event coverage of AUDIT_ANOM_LINK

The userspace audit tools didn't like the existing formatting of the
AUDIT_ANOM_LINK event. It needed to be expanded to emit an AUDIT_PATH
event as well, so this implements the change. The bulk of the patch is
moving code out of auditsc.c into audit.c and audit.h for general use.
It expands audit_log_name to include an optional "struct path" argument
for the simple case of just needing to report a pathname. This also
makes
audit_log_task_info available when syscall auditing is not enabled,
since
it is needed in either case for process details.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Steve Grubb <sgrubb@redhat.com>
include/linux/audit.h
kernel/audit.c
kernel/audit.h
kernel/auditsc.c