linux-kernel - [GIT PULL] Audit patches for 4.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <24856357.PPehG78Es6@sifl>
Date:	Thu, 03 Sep 2015 16:41:05 -0400
From:	Paul Moore <pmoore@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: [GIT PULL] Audit patches for 4.3

Hi Linus,

This is one of the larger audit patchsets in recent history, consisting of 
eight patches and almost 400 lines of changes.  The bulk of the patchset is 
the new "audit by executable" functionality which allows admins to set an 
audit watch based on the executable on disk.  Prior to this, admins could only 
track an application by PID, which has some obvious limitations.  Beyond the 
new functionality we also have some refcnt fixes and a few minor cleanups.  
Please pull for 4.3.

Thanks,
-Paul

---
The following changes since commit 0b08c5e59441d08ab4b5e72afefd5cd98a4d83df:

  audit: Fix check of return value of strnlen_user()
         (2015-06-11 15:49:54 -0400)

are available in the git repository at:

  git://git.infradead.org/users/pcmoore/audit upstream

for you to fetch changes up to 15ce414b82b07acb99afda6e4d9bd14f317b6011:

  fixup: audit: implement audit by executable (2015-08-12 22:04:07 -0400)

----------------------------------------------------------------
Paul Moore (1):
      audit: fix uninitialized variable in audit_add_rule()

Richard Guy Briggs (7):
      audit: eliminate unnecessary extra layer of watch references
      audit: eliminate unnecessary extra layer of watch parent references
      audit: make audit_del_rule() more robust
      audit: use macros for unset inode and device values
      audit: clean simple fsnotify implementation
      audit: implement audit by executable
      fixup: audit: implement audit by executable

 include/linux/audit.h      |   4 +
 include/uapi/linux/audit.h |   5 +-
 kernel/Makefile            |   2 +-
 kernel/audit.c             |   2 +-
 kernel/audit.h             |  18 ++++
 kernel/audit_fsnotify.c    | 216 ++++++++++++++++++++++++++++++++++++++++++
 kernel/audit_tree.c        |   2 +
 kernel/audit_watch.c       |  56 +++++++++---
 kernel/auditfilter.c       |  83 ++++++++++++-----
 kernel/auditsc.c           |   9 +-
 10 files changed, 359 insertions(+), 38 deletions(-)
 create mode 100644 kernel/audit_fsnotify.c

-- 
paul moore
security @ redhat

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/