git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-04-18 03:23:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

audit: add record for multiple object contexts

Browse Source 
Create a new audit record AUDIT_MAC_OBJ_CONTEXTS.
An example of the MAC_OBJ_CONTEXTS record is:

    type=MAC_OBJ_CONTEXTS
      msg=audit(1601152467.009:1050):
      obj_selinux=unconfined_u:object_r:user_home_t:s0

When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record
the "obj=" field in other records in the event will be "obj=?".
An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has
multiple security modules that may make access decisions based
on an object security context.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subj tweak, audit example readability indents]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler
2025-08-16 10:28:59 -07:00
committed by Paul Moore
parent eb59d494ee
commit 0ffbc876d0
6 changed files with 78 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
security/selinux/hooks.c
View File

@@ -7619,7 +7619,9 @@ static __init int selinux_init(void)
cred_init_security();
/* Inform the audit system that secctx is used */
audit_cfg_lsm(&selinux_lsmid, AUDIT_CFG_LSM_SECCTX_SUBJECT);
audit_cfg_lsm(&selinux_lsmid,
AUDIT_CFG_LSM_SECCTX_SUBJECT |
AUDIT_CFG_LSM_SECCTX_OBJECT);
default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
if (!default_noexec)