• Richard Guy Briggs's avatar
    audit: add saddr_fam filter field · bf361231
    Richard Guy Briggs authored
    Provide a method to filter out sockaddr and bind calls by network
    address family.
    
    Existing SOCKADDR records are listed for any network activity.
    Implement the AUDIT_SADDR_FAM field selector to be able to classify or
    limit records to specific network address families, such as AF_INET or
    AF_INET6.
    
    An example of a network record that is unlikely to be useful and flood
    the logs:
    
    type=SOCKADDR msg=audit(07/27/2017 12:18:27.019:845) : saddr={ fam=local
    path=/var/run/nscd/socket }
    type=SYSCALL msg=audit(07/27/2017 12:18:27.019:845) : arch=x86_64
    syscall=connect success=no exit=ENOENT(No such file or directory) a0=0x3
    a1=0x7fff229c4980 a2=0x6e a3=0x6 items=1 ppid=3301 pid=6145 auid=sgrubb
    uid=sgrubb gid=sgrubb euid=sgrubb suid=sgrubb fsuid=sgrubb egid=sgrubb
    sgid=sgrubb fsgid=sgrubb tty=pts3 ses=4 comm=bash exe=/usr/bin/bash
    subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
    key=network-test
    
    Please see the audit-testsuite PR at
    https://github.com/linux-audit/audit-testsuite/pull/87
    Please see the github issue
    https://github.com/linux-audit/audit-kernel/issues/64
    Please see the github issue for the accompanying userspace support
    https://github.com/linux-audit/audit-userspace/issues/93Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    [PM: merge fuzz in auditfilter.c]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    bf361231
auditsc.c 69.5 KB