[RFC PATCH ghak10 v2 3/4] timekeeping: Audit attempts to adjust the clock

[Ondrej Mosnacek <omosnace@redhat.com>]

(Intentionally not sending to the timekeeping maintainers just yet,
let's settle on the record contents/format first.)

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 kernel/time/timekeeping.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 4786df904c22..02097a7d225e 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -25,6 +25,7 @@
 #include <linux/stop_machine.h>
 #include <linux/pvclock_gtod.h>
 #include <linux/compiler.h>
+#include <linux/audit.h>
 
 #include "tick-internal.h"
 #include "ntp_internal.h"
@@ -2315,6 +2316,16 @@ int do_adjtimex(struct timex *txc)
 	raw_spin_lock_irqsave(&timekeeper_lock, flags);
 	write_seqcount_begin(&tk_core.seq);
 
+	/* Only log audit event if the clock was changed/attempted to be changed.
+	 * Based on the logic inside timekeeping_validate_timex().
+	 * NOTE: We need to log the event before any of the fields get
+	 * overwritten by the output values (__do_adjtimex() does not fail, so
+	 * it is OK to do it here). */
+	if (   ( (txc->modes & ADJ_ADJTIME) && !(txc->modes & ADJ_OFFSET_READONLY))
+	    || (!(txc->modes & ADJ_ADJTIME) &&   txc->modes)
+	    ||   (txc->modes & ADJ_SETOFFSET))
+		audit_adjtime(txc);
+
 	orig_tai = tai = tk->tai_offset;
 	ret = __do_adjtimex(txc, &ts, &tai);
 
-- 
2.17.1