audit: add filtering for io_uring records
authorPaul Moore <paul@paul-moore.com>
Mon, 19 Apr 2021 01:54:47 +0000 (21:54 -0400)
committerPaul Moore <paul@paul-moore.com>
Mon, 20 Sep 2021 02:34:38 +0000 (22:34 -0400)
commit67daf270cebcf7aab4b3292b36f9adf357b23ddc
tree6f5bbbe164b0f6e45c269291b908c4ae1116d17f
parent5bd2182d58e9d9c6279b7a8a2f9b41add0e7f9cb
audit: add filtering for io_uring records

This patch adds basic audit io_uring filtering, using as much of the
existing audit filtering infrastructure as possible.  In order to do
this we reuse the audit filter rule's syscall mask for the io_uring
operation and we create a new filter for io_uring operations as
AUDIT_FILTER_URING_EXIT/audit_filter_list[7].

Thanks to Richard Guy Briggs for his review, feedback, and work on
the corresponding audit userspace changes.

Acked-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
include/uapi/linux/audit.h
kernel/audit_tree.c
kernel/audit_watch.c
kernel/auditfilter.c
kernel/auditsc.c