audit: Add new syscalls to the perm=w filter

The audit subsystem allows selecting audit events based on watches for
a particular behavior like writing to a file. A lot of syscalls have
been added without updating the list. This patch adds 2 syscalls to the
write filters: fallocate and renameat2.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: cleaned up some whitespace errors]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/include/asm-generic/audit_dir_write.h b/include/asm-generic/audit_dir_write.h
index 7b61db4..cf1ebc3 100644 (file)
--- a/include/asm-generic/audit_dir_write.h
+++ b/include/asm-generic/audit_dir_write.h
@@ -30,3 +30,6 @@ __NR_renameat,
 __NR_linkat,
 __NR_symlinkat,
 #endif
+#ifdef __NR_renameat2
+__NR_renameat2,
+#endif

diff --git a/include/asm-generic/audit_write.h b/include/asm-generic/audit_write.h
index 274575d..f5c4906 100644 (file)
--- a/include/asm-generic/audit_write.h
+++ b/include/asm-generic/audit_write.h
@@ -19,3 +19,6 @@ __NR_ftruncate64,
 #ifdef __NR_bind
 __NR_bind,             /* bind can affect fs object only in one way... */
 #endif
+#ifdef __NR_fallocate
+__NR_fallocate,
+#endif