audit: allow audit matching on inode gid
Eric Paris [Tue, 3 Jan 2012 19:23:07 +0000 (14:23 -0500)]
Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris <eparis@redhat.com>

include/linux/audit.h
kernel/auditfilter.c
kernel/auditsc.c

index 55cb3da..e36aa37 100644 (file)
 #define AUDIT_DIR      107
 #define AUDIT_FILETYPE 108
 #define AUDIT_OBJ_UID  109
+#define AUDIT_OBJ_GID  110
 
 #define AUDIT_ARG0      200
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
index 13e9974..f10605c 100644 (file)
@@ -462,6 +462,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                case AUDIT_ARG2:
                case AUDIT_ARG3:
                case AUDIT_OBJ_UID:
+               case AUDIT_OBJ_GID:
                        break;
                case AUDIT_ARCH:
                        entry->rule.arch_f = f;
index 5cf3ecc..87b375f 100644 (file)
@@ -598,6 +598,18 @@ static int audit_filter_rules(struct task_struct *tsk,
                                }
                        }
                        break;
+               case AUDIT_OBJ_GID:
+                       if (name) {
+                               result = audit_comparator(name->gid, f->op, f->val);
+                       } else if (ctx) {
+                               list_for_each_entry(n, &ctx->names_list, list) {
+                                       if (audit_comparator(n->gid, f->op, f->val)) {
+                                               ++result;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
                case AUDIT_WATCH:
                        if (name)
                                result = audit_watch_compare(rule->watch, name->ino, name->dev);