From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ondrej Mosnacek Subject: [RFC PATCH ghak10 v2 3/4] timekeeping: Audit attempts to adjust the clock Date: Tue, 19 Jun 2018 15:59:00 +0200 Message-ID: <20180619135901.31473-4-omosnace@redhat.com> References: <20180619135901.31473-1-omosnace@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx17.extmail.prod.ext.phx2.redhat.com [10.5.110.46]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E30145C3F8 for ; Tue, 19 Jun 2018 13:59:42 +0000 (UTC) Received: from mail-wm0-f69.google.com (mail-wm0-f69.google.com [74.125.82.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4F2CB307C944 for ; Tue, 19 Jun 2018 13:59:42 +0000 (UTC) Received: by mail-wm0-f69.google.com with SMTP id f65-v6so245023wmd.2 for ; Tue, 19 Jun 2018 06:59:42 -0700 (PDT) In-Reply-To: <20180619135901.31473-1-omosnace@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com (Intentionally not sending to the timekeeping maintainers just yet, let's settle on the record contents/format first.) Signed-off-by: Ondrej Mosnacek --- kernel/time/timekeeping.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index 4786df904c22..02097a7d225e 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "tick-internal.h" #include "ntp_internal.h" @@ -2315,6 +2316,16 @@ int do_adjtimex(struct timex *txc) raw_spin_lock_irqsave(&timekeeper_lock, flags); write_seqcount_begin(&tk_core.seq); + /* Only log audit event if the clock was changed/attempted to be changed. + * Based on the logic inside timekeeping_validate_timex(). + * NOTE: We need to log the event before any of the fields get + * overwritten by the output values (__do_adjtimex() does not fail, so + * it is OK to do it here). */ + if ( ( (txc->modes & ADJ_ADJTIME) && !(txc->modes & ADJ_OFFSET_READONLY)) + || (!(txc->modes & ADJ_ADJTIME) && txc->modes) + || (txc->modes & ADJ_SETOFFSET)) + audit_adjtime(txc); + orig_tai = tai = tk->tai_offset; ret = __do_adjtimex(txc, &ts, &tai); -- 2.17.1