From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?q?Miloslav=20Trma=C4=8D?= Subject: [PATCH 0/5] RFC v2: AF_ALG auditing Date: Wed, 24 Nov 2010 18:05:50 +0100 Message-ID: <1290618355-31193-1-git-send-email-mitr@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Sender: linux-crypto-owner@vger.kernel.org To: eparis@redhat.com, herbert@gondor.hengli.com.au Cc: linux-audit@redhat.com, linux-crypto@vger.kernel.org, =?UTF-8?q?Miloslav=20Trma=C4=8D?= List-Id: linux-audit@redhat.com Hello, these patches add support for auditing uses of the AF_ALG protocol fami= ly developed by Herbert Xu to provide user-space access to kernel crypto accelerators. One new record is defined: AUDIT_CRYPTO_USERSPACE_OP. An audited event is always caused by a syscall, and all other syscall-related data (process identity, syscall result) is audited in the usual records. To disable auditing crypto by default and to allow the users to selectively enable them using filters, a new filter field AUDIT_CRYPTO_OP is defined; auditing of all crypto operations can thus be enabled using (auditctl -a exit,always -F crypto_op!=3D0). Changes since the previous version: * Use audit_aux_data instead of a separate linked list * Don't overwrite initial values of "err" by 0 in algif_skcipher.c Mirek Miloslav Trma=C4=8D (5): Add general crypto auditing infrastructure Add unique IDs to AF_ALG sockets Add "alg_name" operation to af_alg_type. Audit type-independent events Audit type-specific crypto operations crypto/af_alg.c | 110 +++++++++++++++++++++++++++++++++++++++= +++++++- crypto/algif_hash.c | 35 +++++++++++++-- crypto/algif_skcipher.c | 28 +++++++++++- include/crypto/if_alg.h | 17 +++++-- include/linux/audit.h | 22 +++++++++ kernel/auditfilter.c | 2 + kernel/auditsc.c | 97 +++++++++++++++++++++++++++++++++++++++= ++ 7 files changed, 296 insertions(+), 15 deletions(-) --=20 1.7.3.2