[GIT PULL] audit/audit-pr-20250527

[GIT PULL] audit/audit-pr-20250527

[Paul Moore]

Linus,

Two audit patches for the Linux v6.16 merge window:

- Always record AUDIT_ANOM events when auditing is enabled.

  Prior to this patch we only recorded AUDIT_ANOM events if auditing was
  enabled and the admin/distro had explicitly configured audit beyond the
  defaults.  Considering that AUDIT_ANOM events are anomolous events
  considered to be "security relevant", it seems wise to record these
  events as long as auditing is enabled, even if the system is running
  with a default audit configuration.

- Mark the audit_log_vformat() function with the __printf() attribute
  to quiet GCC.

Paul

--
The following changes since commit 0af2f6be1b4281385b618cb86ad946eded089ac8:

  Linux 6.15-rc1 (2025-04-06 13:11:33 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
    tags/audit-pr-20250527

for you to fetch changes up to 654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c:

  audit: record AUDIT_ANOM_* events regardless of presence of rules
    (2025-04-11 14:14:41 -0400)

----------------------------------------------------------------
audit-pr-20250527
----------------------------------------------------------------

Andy Shevchenko (1):
      audit: mark audit_log_vformat() with __printf() attribute

Richard Guy Briggs (1):
      audit: record AUDIT_ANOM_* events regardless of presence of rules

 kernel/audit.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--
paul-moore.com

Re: [GIT PULL] audit/audit-pr-20250527

[pr-tracker-bot]

The pull request you sent on Tue, 27 May 2025 18:57:45 -0400:

> https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20250527

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/3d413f0cfd7ef0fe478e98fafcc084209520abd0

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html