From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ondrej Mosnacek Subject: [RFC PATCH ghak10 v3 1/3] audit: Add AUDIT_TIME_* record types Date: Tue, 3 Jul 2018 14:44:35 +0200 Message-ID: <20180703124437.22733-2-omosnace@redhat.com> References: <20180703124437.22733-1-omosnace@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx10.extmail.prod.ext.phx2.redhat.com [10.5.110.39]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3B83260A98 for ; Tue, 3 Jul 2018 12:44:59 +0000 (UTC) Received: from mail-wr0-f198.google.com (mail-wr0-f198.google.com [209.85.128.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A56595D5E8 for ; Tue, 3 Jul 2018 12:44:59 +0000 (UTC) Received: by mail-wr0-f198.google.com with SMTP id j89-v6so956068wrj.20 for ; Tue, 03 Jul 2018 05:44:59 -0700 (PDT) In-Reply-To: <20180703124437.22733-1-omosnace@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com This patch adds two auxiliary record types that will be used to annotate the adjtimex SYSCALL records with the NTP/timekeeping values that have been changed (if any). Signed-off-by: Ondrej Mosnacek --- include/uapi/linux/audit.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 4e3eaba84175..242ce562b41a 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -114,6 +114,8 @@ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ +#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */ +#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ -- 2.17.1