• G
    [PATCH] Audit of POSIX Message Queue Syscalls v.2 · 20ca73bc
    George C. Wilson 提交于
    This patch adds audit support to POSIX message queues.  It applies cleanly to
    the lspp.b15 branch of Al Viro's git tree.  There are new auxiliary data
    structures, and collection and emission routines in kernel/auditsc.c.  New hooks
    in ipc/mqueue.c collect arguments from the syscalls.
    
    I tested the patch by building the examples from the POSIX MQ library tarball.
    Build them -lrt, not against the old MQ library in the tarball.  Here's the URL:
    http://www.geocities.com/wronski12/posix_ipc/libmqueue-4.41.tar.gz
    Do auditctl -a exit,always -S for mq_open, mq_timedsend, mq_timedreceive,
    mq_notify, mq_getsetattr.  mq_unlink has no new hooks.  Please see the
    corresponding userspace patch to get correct output from auditd for the new
    record types.
    
    [fixes folded]
    Signed-off-by: NGeorge Wilson <ltcgcw@us.ibm.com>
    Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
    20ca73bc
mqueue.c 29.8 KB