audit: add missing syscalls to read class

The "at" variant of getxattr() and listxattr() are missing from the
audit read class. Calling getxattrat() or listxattrat() on a file to
read its extended attributes will bypass audit rules such as:

-w /tmp/test -p rwa -k test_rwa

The current patch adds missing syscalls to the audit read class.

Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Jeffrey Bencteux
2025-12-27 09:39:24 +01:00
committed by Paul Moore
parent 15b0c43aa6
commit bcb90a2834

View File

@@ -4,9 +4,15 @@ __NR_readlink,
#endif
__NR_quotactl,
__NR_listxattr,
#ifdef __NR_listxattrat
__NR_listxattrat,
#endif
__NR_llistxattr,
__NR_flistxattr,
__NR_getxattr,
#ifdef __NR_getxattrat
__NR_getxattrat,
#endif
__NR_lgetxattr,
__NR_fgetxattr,
#ifdef __NR_readlinkat