From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: [PATCH 1/1] audit: Add new syscalls to the perm=w filter Date: Thu, 12 Oct 2017 23:24:01 -0400 Message-ID: <3684595.EFLXjLr4XY@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit Cc: rgb@redhat.com List-Id: linux-audit@redhat.com The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2. Signed-off-by: sgrubb --- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+) diff --git a/include/asm-generic/audit_dir_write.h b/include/asm-generic/audit_dir_write.h index 7b61db4fe72b..d9a53eaeea35 100644 --- a/include/asm-generic/audit_dir_write.h +++ b/include/asm-generic/audit_dir_write.h @@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat, #endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif + diff --git a/include/asm-generic/audit_write.h b/include/asm-generic/audit_write.h index 274575d7129f..4fa65816acd3 100644 --- a/include/asm-generic/audit_write.h +++ b/include/asm-generic/audit_write.h @@ -19,3 +19,6 @@ __NR_ftruncate64, #ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */ #endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif -- 2.13.6