Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fbabf31e authored by Thomas Graf's avatar Thomas Graf Committed by Patrick McHardy
Browse files

netfilter: create audit records for x_tables replaces 



The setsockopt() syscall to replace tables is already recorded
in the audit logs. This patch stores additional information
such as table name and netfilter protocol.

Cc: Patrick McHardy <kaber@trash.net>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarThomas Graf <tgraf@redhat.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 43f393ca

include/linux/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -104,6 +104,7 @@ 
#define AUDIT_CAPSET		1322	/* Record showing argument to sys_capset */

#define AUDIT_MMAP		1323	/* Record showing descriptor and flags in mmap */

#define AUDIT_NETFILTER_PKT	1324	/* Packets traversing netfilter chains */

#define AUDIT_NETFILTER_CFG	1325	/* Netfilter chain modifications */



#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

net/netfilter/x_tables.c

+16 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <linux/mutex.h>

#include <linux/mm.h>

#include <linux/slab.h>

#include <linux/audit.h>

#include <net/net_namespace.h>



#include <linux/netfilter/x_tables.h>
@@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table, 
	 */

	local_bh_enable();



#ifdef CONFIG_AUDIT

	if (audit_enabled) {

		struct audit_buffer *ab;



		ab = audit_log_start(current->audit_context, GFP_KERNEL,

				     AUDIT_NETFILTER_CFG);

		if (ab) {

			audit_log_format(ab, "table=%s family=%u entries=%u",

					 table->name, table->af,

					 private->number);

			audit_log_end(ab);

		}

	}

#endif



	return private;

}

EXPORT_SYMBOL_GPL(xt_replace_table);