From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ondrej Mosnacek Subject: [RFC PATCH ghak10 v2 0/5] audit: Log modifying adjtimex(2) calls Date: Tue, 19 Jun 2018 15:58:57 +0200 Message-ID: <20180619135901.31473-1-omosnace@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx08.extmail.prod.ext.phx2.redhat.com [10.5.110.32]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B1AE8608F3 for ; Tue, 19 Jun 2018 13:59:38 +0000 (UTC) Received: from mail-wr0-f199.google.com (mail-wr0-f199.google.com [209.85.128.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 56D98C057FA8 for ; Tue, 19 Jun 2018 13:59:38 +0000 (UTC) Received: by mail-wr0-f199.google.com with SMTP id k12-v6so14298725wrl.21 for ; Tue, 19 Jun 2018 06:59:38 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com This patchset adds a new AUDIT_TIME_ADJUSTED record type, which is associated to the adjtimex(2) syscall record whenever it is invoked in non-read-only mode. Changes in v2: - The audit_adjtime() function has been modified to only log those fields that contain values that are actually used, resulting in more compact records. - The audit_adjtime() call has been moved to do_adjtimex() in timekeeping.c - Added an additional patch (for review) that simplifies the detection if the syscall is read-only.