linux-kernel - [GIT PULL] audit/audit-pr-20250926

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3161e6addb7d3e6c8297ff058ad8236d@paul-moore.com>
Date: Fri, 26 Sep 2025 23:07:27 -0400
From: Paul Moore <paul@...l-moore.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: audit@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [GIT PULL] audit/audit-pr-20250926

Linus,

Here are the audit patches for the upcoming Linux v6.18 merge window:

- Proper audit support for multiple LSMs

  As the audit subsystem predated the work to enable multiple LSMs,
  some additional work was needed to support logging the different LSM
  labels for the subjects/tasks and objects on the system.  Casey's
  patches add new auxillary records for subjects and objects that convey
  the additional labels.

- Ensure fanotify audit events are always generated  

  Generally speaking security relevant subsystems always generate audit
  events, unless explicitly ignored.  However, up to this point fanotify
  events had been ignored by default, but starting with this pull request
  fanotify follows convention and generates audit events by default.

- Replace an instance of strcpy() with strscpy()  

- Minor indentation, style, and comment fixes

Paul

--
The following changes since commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585:

  Linux 6.17-rc1 (2025-08-10 19:41:16 +0300)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
    tags/audit-pr-20250926

for you to fetch changes up to d2c773159327f4d2f6438acf1ae2ae9ac0ca46a9:

  audit: fix skb leak when audit rate limit is exceeded
    (2025-09-10 19:55:00 -0400)

----------------------------------------------------------------
audit/stable-6.18 PR 20250926
----------------------------------------------------------------

Casey Schaufler (5):
      audit: fix indentation in audit_log_exit()
      audit: create audit_stamp structure
      lsm: security_lsmblob_to_secctx module selection
      audit: add record for multiple task security contexts
      audit: add record for multiple object contexts

Dan Carpenter (1):
      audit: add a missing tab

Eric Dumazet (1):
      audit: init ab->skb_list earlier in audit_buffer_alloc()

Gerald Yang (1):
      audit: fix skb leak when audit rate limit is exceeded

Kieran Moy (1):
      audit: fix typo in auditfilter.c comment

Richard Guy Briggs (1):
      audit: record fanotify event regardless of presence of rules

Thorsten Blum (1):
      audit: Replace deprecated strcpy() with strscpy()

 include/linux/audit.h        |   25 +++
 include/linux/security.h     |    6 
 include/uapi/linux/audit.h   |    2 
 kernel/audit.c               |  280 ++++++++++++++++++++++++++++++-----
 kernel/audit.h               |   13 +
 kernel/audit_tree.c          |    6 
 kernel/auditfilter.c         |    2 
 kernel/auditsc.c             |   63 ++-----
 net/netlabel/netlabel_user.c |    8 -
 security/apparmor/lsm.c      |    3 
 security/security.c          |   18 ++
 security/selinux/hooks.c     |    5 
 security/smack/smack_lsm.c   |    5 
 13 files changed, 334 insertions(+), 102 deletions(-)

--
paul-moore.com