Kees Cook 7b9205bd77 audit: create explicit AUDIT_SECCOMP event type
The seccomp path was using AUDIT_ANOM_ABEND from when seccomp mode 1
could only kill a process.  While we still want to make sure an audit
record is forced on a kill, this should use a separate record type since
seccomp mode 2 introduces other behaviors.

In the case of "handled" behaviors (process wasn't killed), only emit a
record if the process is under inspection.  This change also fixes
userspace examination of seccomp audit events, since it was considered
malformed due to missing fields of the AUDIT_ANOM_ABEND event type.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jeff Layton <jlayton@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Julien Tinnes <jln@google.com>
Acked-by: Will Drewry <wad@chromium.org>
Acked-by: Steve Grubb <sgrubb@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-01-11 14:54:55 -08:00
..
2013-01-02 17:36:10 -08:00
2012-12-11 11:19:09 -08:00
2012-12-13 19:26:04 -08:00
2013-01-02 17:36:10 -08:00
2012-12-07 17:02:47 +00:00
2013-01-02 17:36:10 -08:00
2012-11-30 12:37:36 +01:00
2012-10-08 13:50:20 +10:30
2012-12-02 00:05:12 +00:00
2012-11-15 00:34:23 +01:00
2012-12-20 13:57:36 -05:00
2012-12-21 20:23:41 +00:00
2012-11-08 16:58:31 +01:00
2012-11-28 11:54:40 +01:00
2012-10-16 18:49:15 -07:00
2012-11-22 13:43:27 +09:00
2012-11-28 21:49:02 -05:00
2012-11-28 21:49:02 -05:00
2012-11-08 16:58:30 +01:00
2012-11-21 10:07:48 +01:00
2012-10-29 21:31:32 +01:00
2012-12-16 15:18:08 -08:00
2012-12-16 15:18:08 -08:00
2012-11-23 12:23:40 +01:00
2012-12-14 13:05:26 +10:30
2012-11-21 15:09:26 -08:00
2012-11-20 16:15:02 +10:00
2012-11-03 14:50:15 -04:00
2012-10-10 01:15:44 -04:00
2012-12-12 17:38:33 -08:00
2012-12-16 15:18:08 -08:00
2012-12-20 18:46:29 -05:00
2012-10-10 20:00:55 +10:30
2012-12-14 13:06:40 +10:30
2012-12-25 18:45:06 -05:00
2012-12-11 17:22:27 -08:00
2012-10-17 15:53:02 -05:00
2012-10-10 22:41:05 -04:00
2012-12-13 12:14:47 -08:00
2013-01-03 15:57:14 -08:00
2012-11-16 14:33:04 -08:00
2012-10-06 03:05:01 +09:00
2012-12-18 15:02:13 -08:00
2012-12-18 15:02:14 -08:00
2012-10-27 15:38:29 -07:00
2012-10-09 16:22:55 +09:00
2012-10-09 16:22:32 +09:00
2012-10-22 16:58:28 -07:00
2012-11-15 17:20:58 -08:00
2012-12-16 15:18:08 -08:00