audit: issue CWD record to accompany LSM_AUDIT_DATA_* records
authorRichard Guy Briggs <rgb@redhat.com>
Fri, 3 Jul 2020 16:56:19 +0000 (12:56 -0400)
committerPaul Moore <paul@paul-moore.com>
Wed, 8 Jul 2020 23:02:11 +0000 (19:02 -0400)
commitd7481b24b816b8c3955a9eaf01b97e2bd7f61a37
tree0809d95b1ab314464940e38ffaa640eb9670fe65
parent68df2ed54487679f815d61b750d3bcf733ffd79e
audit: issue CWD record to accompany LSM_AUDIT_DATA_* records

The LSM_AUDIT_DATA_* records for PATH, FILE, IOCTL_OP, DENTRY and INODE
are incomplete without the task context of the AUDIT Current Working
Directory record.  Add it.

This record addition can't use audit_dummy_context to determine whether
or not to store the record information since the LSM_AUDIT_DATA_*
records are initiated by various LSMs independent of any audit rules.
context->in_syscall is used to determine if it was called in user
context like audit_getname.

Please see the upstream issue
https://github.com/linux-audit/audit-kernel/issues/96

Adapted from Vladis Dronov's v2 patch.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
include/linux/audit.h
kernel/auditsc.c
security/lsm_audit.c