From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Viro Subject: filter by ppid Date: Sat, 6 May 2006 08:46:19 -0400 Message-ID: <20060506124619.GB29125@devserv.devel.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from devserv.devel.redhat.com (devserv.devel.redhat.com [172.16.58.1]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k46CkJDH023040 for ; Sat, 6 May 2006 08:46:19 -0400 Received: from devserv.devel.redhat.com (localhost.localdomain [127.0.0.1]) by devserv.devel.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k46CkJuS025165 for ; Sat, 6 May 2006 08:46:19 -0400 Received: (from aviro@localhost) by devserv.devel.redhat.com (8.12.11.20060308/8.12.11/Submit) id k46CkJR1025163 for linux-audit@redhat.com; Sat, 6 May 2006 08:46:19 -0400 Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Signed-off-by: Al Viro --- include/linux/audit.h | 1 + kernel/auditsc.c | 4 ++++ 2 files changed, 5 insertions(+), 0 deletions(-) 5577dff75cbaab5635a5c8127a7f8fb2a9727baf diff --git a/include/linux/audit.h b/include/linux/audit.h index 103ed6d..b32d91b 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -152,6 +152,7 @@ #define AUDIT_SE_TYPE 15 /* security label type */ #define AUDIT_SE_SEN 16 /* security label sensitivity label */ #define AUDIT_SE_CLR 17 /* security label clearance label */ +#define AUDIT_PPID 18 /* These are ONLY useful when checking * at syscall exit time (AUDIT_AT_EXIT). */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4fc3867..e455165 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -188,6 +188,10 @@ static int audit_filter_rules(struct tas case AUDIT_PID: result = audit_comparator(tsk->pid, f->op, f->val); break; + case AUDIT_PPID: + if (ctx) + result = audit_comparator(ctx->ppid, f->op, f->val); + break; case AUDIT_UID: result = audit_comparator(tsk->uid, f->op, f->val); break; -- 0.99.9.GIT