Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c66251e authored by Al Viro's avatar Al Viro
Browse files

[PATCH] add filtering by ppid 



Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent f46038ff

include/linux/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -152,6 +152,7 @@ 
#define AUDIT_SE_TYPE	15	/* security label type */

#define AUDIT_SE_SEN	16	/* security label sensitivity label */

#define AUDIT_SE_CLR	17	/* security label clearance label */

#define AUDIT_PPID	18



				/* These are ONLY useful when checking

				 * at syscall exit time (AUDIT_AT_EXIT). */

kernel/auditsc.c

+4 −0
Original line number Diff line number Diff line
@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk, 
		case AUDIT_PID:

			result = audit_comparator(tsk->pid, f->op, f->val);

			break;

		case AUDIT_PPID:

			if (ctx)

				result = audit_comparator(ctx->ppid, f->op, f->val);

			break;

		case AUDIT_UID:

			result = audit_comparator(tsk->uid, f->op, f->val);

			break;