diff options
| author | Thomas Graf <tgraf@infradead.org> | 2011-01-16 18:12:59 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-01-16 18:12:59 +0100 |
| commit | fbabf31e4d482149b5e2704eb0287cf9117bdcf3 (patch) | |
| tree | b12a1123474ab9aa566fc1a6e57e050653588ba0 | |
| parent | 43f393caec0362abe03c72799d3f342af3973070 (diff) | |
| download | linux-3.10-fbabf31e4d482149b5e2704eb0287cf9117bdcf3.tar.gz linux-3.10-fbabf31e4d482149b5e2704eb0287cf9117bdcf3.tar.bz2 linux-3.10-fbabf31e4d482149b5e2704eb0287cf9117bdcf3.zip | |
netfilter: create audit records for x_tables replaces
The setsockopt() syscall to replace tables is already recorded
in the audit logs. This patch stores additional information
such as table name and netfilter protocol.
Cc: Patrick McHardy <kaber@trash.net>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Thomas Graf <tgraf@redhat.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
| -rw-r--r-- | include/linux/audit.h | 1 | ||||
| -rw-r--r-- | net/netfilter/x_tables.c | 16 |
2 files changed, 17 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index ae227dfcf9c..32b5c62a504 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -104,6 +104,7 @@ #define AUDIT_CAPSET 1322 /* Record showing argument to sys_capset */ #define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */ #define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */ +#define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index ee5de3af510..fbc2b72091e 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -23,6 +23,7 @@ #include <linux/mutex.h> #include <linux/mm.h> #include <linux/slab.h> +#include <linux/audit.h> #include <net/net_namespace.h> #include <linux/netfilter/x_tables.h> @@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table, */ local_bh_enable(); +#ifdef CONFIG_AUDIT + if (audit_enabled) { + struct audit_buffer *ab; + + ab = audit_log_start(current->audit_context, GFP_KERNEL, + AUDIT_NETFILTER_CFG); + if (ab) { + audit_log_format(ab, "table=%s family=%u entries=%u", + table->name, table->af, + private->number); + audit_log_end(ab); + } + } +#endif + return private; } EXPORT_SYMBOL_GPL(xt_replace_table); |