[PATCH v2] audit: add missing syscalls to signal class

[PATCH v2] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
to be used only in kernel/auditfilter.c to increment the audit_signals
counter.

This counter is used to determine if information related to a target
process of a syscall audit rule using signals, such as its pid,
should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).

Information related to signals sent via these system calls are
currently not correctly logged. The current patch adds it to the
AUDIT_CLASS_SIGNAL* class.

Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
---
Changes in v2:
- Removal of unneeded #ifdef guards

 include/asm-generic/audit_signal.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/asm-generic/audit_signal.h b/include/asm-generic/audit_signal.h
index 6feab7f18a53..c02edbee3311 100644
--- a/include/asm-generic/audit_signal.h
+++ b/include/asm-generic/audit_signal.h
@@ -1,3 +1,6 @@
 __NR_kill,
 __NR_tgkill,
 __NR_tkill,
+__NR_rt_sigqueueinfo,
+__NR_rt_tgsigqueueinfo,
+__NR_pidfd_send_signal,

base-commit: 6614d4c05c7a661a925b3d8dbf9c70faac3bd2da
-- 
2.56.0

Re: [PATCH v2] audit: add missing syscalls to signal class

[sashiko-bot]

> The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
> system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
> to be used only in kernel/auditfilter.c to increment the audit_signals
> counter.
> 
> This counter is used to determine if information related to a target
> process of a syscall audit rule using signals, such as its pid,
> should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).
> 
> Information related to signals sent via these system calls are
> currently not correctly logged. The current patch adds it to the
> AUDIT_CLASS_SIGNAL* class.
> 
> Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111152057.59798-2-jeff@bencteux.fr?part=1

Re: [PATCH v2] audit: add missing syscalls to signal class

[Ricardo Robaina]

On Wed, Nov 11, 2026 at 1:36 PM <sashiko-bot@kernel.org> wrote:
>
> > The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
> > system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
> > to be used only in kernel/auditfilter.c to increment the audit_signals
> > counter.
> >
> > This counter is used to determine if information related to a target
> > process of a syscall audit rule using signals, such as its pid,
> > should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).
> >
> > Information related to signals sent via these system calls are
> > currently not correctly logged. The current patch adds it to the
> > AUDIT_CLASS_SIGNAL* class.
> >
> > Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
>
> Sashiko has reviewed this patch and found no issues.
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20261111152057.59798-2-jeff@bencteux.fr?part=1
>
>

Looks good to me.

Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>