From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [RFC][PATCH] audit: get inode pathname patch Date: Wed, 6 Aug 2008 13:26:36 -0500 Message-ID: <20080806182636.GA32522@us.ibm.com> References: <1218033406.9023.7.camel@new-host-2.home> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m76IQxFE003931 for ; Wed, 6 Aug 2008 14:26:59 -0400 Received: from e31.co.us.ibm.com (e31.co.us.ibm.com [32.97.110.149]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m76IQks7026032 for ; Wed, 6 Aug 2008 14:26:46 -0400 Received: from d03relay04.boulder.ibm.com (d03relay04.boulder.ibm.com [9.17.195.106]) by e31.co.us.ibm.com (8.13.8/8.13.8) with ESMTP id m76IQdqe013953 for ; Wed, 6 Aug 2008 14:26:39 -0400 Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168]) by d03relay04.boulder.ibm.com (8.13.8/8.13.8/NCO v9.0) with ESMTP id m76IQdLU159064 for ; Wed, 6 Aug 2008 12:26:39 -0600 Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1]) by d03av02.boulder.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id m76IQcp8023834 for ; Wed, 6 Aug 2008 12:26:39 -0600 Content-Disposition: inline In-Reply-To: <1218033406.9023.7.camel@new-host-2.home> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Mimi Zohar Cc: David Safford , Linux Audit , Reiner Sailer List-Id: linux-audit@redhat.com Quoting Mimi Zohar (zohar@linux.vnet.ibm.com): > We are interested in using auditing's context pathname information. > Is this the best way of accessing it? > > Add support for accessing auditing's inode full pathname. Interesting idea. It does seem to do what you need. -serge > Signed-off-by: Mimi Zohar > > Index: security-testing-2.6/include/linux/audit.h > =================================================================== > --- security-testing-2.6.orig/include/linux/audit.h > +++ security-testing-2.6/include/linux/audit.h > @@ -403,6 +403,8 @@ extern void audit_syscall_entry(int arch > unsigned long a2, unsigned long a3); > extern void audit_syscall_exit(int failed, long return_code); > extern void __audit_getname(const char *name); > +extern const char *audit_get_inode_pathname(struct task_struct *tsk, > + struct inode *inode); > extern void audit_putname(const char *name); > extern void __audit_inode(const char *name, const struct dentry *dentry); > extern void __audit_inode_child(const char *dname, const struct dentry *dentry, > Index: security-testing-2.6/kernel/auditsc.c > =================================================================== > --- security-testing-2.6.orig/kernel/auditsc.c > +++ security-testing-2.6/kernel/auditsc.c > @@ -1677,6 +1677,28 @@ retry: > #endif > } > > +const char *audit_get_inode_pathname(struct task_struct *tsk, > + struct inode *inode) > +{ > + struct audit_context *context; > + int idx; > + > + context = tsk->audit_context; > + if (!context) > + return NULL; > + for (idx = 0; idx < context->name_count; idx++) { > + struct audit_names *n = &context->names[idx]; > + > + if (!n->name) > + continue; > + > + if (n->ino == inode->i_ino) > + return n->name; > + } > + return NULL; > +} > +EXPORT_SYMBOL_GPL(audit_get_inode_pathname); > + > /** > * audit_getname - add a name to the list > * @name: name to add > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit