Merge tag 'audit-pr-20190507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore: "We've got a reasonably broad set of audit patches for the v5.2 merge window, the highlights are below: - The biggest change, and the source of all the arch/* changes, is the patchset from Dmitry to help enable some of the work he is doing around PTRACE_GET_SYSCALL_INFO. To be honest, including this in the audit tree is a bit of a stretch, but it does help move audit a little further along towards proper syscall auditing for all arches, and everyone else seemed to agree that audit was a "good" spot for this to land (or maybe they just didn't want to merge it? dunno.). - We can now audit time/NTP adjustments. - We continue the work to connect associated audit records into a single event" * tag 'audit-pr-20190507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: (21 commits) audit: fix a memory leak bug ntp: Audit NTP parameters adjustment timekeeping: Audit clock adjustments audit: purge unnecessary list_empty calls audit: link integrity evm_write_xattrs record to syscall event syscall_get_arch: add "struct task_struct *" argument unicore32: define syscall_get_arch() Move EM_UNICORE to uapi/linux/elf-em.h nios2: define syscall_get_arch() nds32: define syscall_get_arch() Move EM_NDS32 to uapi/linux/elf-em.h m68k: define syscall_get_arch() hexagon: define syscall_get_arch() Move EM_HEXAGON to uapi/linux/elf-em.h h8300: define syscall_get_arch() c6x: define syscall_get_arch() arc: define syscall_get_arch() Move EM_ARCOMPACT and EM_ARCV2 to uapi/linux/elf-em.h audit: Make audit_log_cap and audit_copy_inode static audit: connect LOGIN record to its syscall record ...
This commit is contained in:
@@ -21,6 +21,7 @@
|
||||
#include <linux/stop_machine.h>
|
||||
#include <linux/pvclock_gtod.h>
|
||||
#include <linux/compiler.h>
|
||||
#include <linux/audit.h>
|
||||
|
||||
#include "tick-internal.h"
|
||||
#include "ntp_internal.h"
|
||||
@@ -1250,6 +1251,9 @@ out:
|
||||
/* signal hrtimers about time change */
|
||||
clock_was_set();
|
||||
|
||||
if (!ret)
|
||||
audit_tk_injoffset(ts_delta);
|
||||
|
||||
return ret;
|
||||
}
|
||||
EXPORT_SYMBOL(do_settimeofday64);
|
||||
@@ -2303,6 +2307,7 @@ static int timekeeping_validate_timex(const struct __kernel_timex *txc)
|
||||
int do_adjtimex(struct __kernel_timex *txc)
|
||||
{
|
||||
struct timekeeper *tk = &tk_core.timekeeper;
|
||||
struct audit_ntp_data ad;
|
||||
unsigned long flags;
|
||||
struct timespec64 ts;
|
||||
s32 orig_tai, tai;
|
||||
@@ -2322,15 +2327,19 @@ int do_adjtimex(struct __kernel_timex *txc)
|
||||
ret = timekeeping_inject_offset(&delta);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
audit_tk_injoffset(delta);
|
||||
}
|
||||
|
||||
audit_ntp_init(&ad);
|
||||
|
||||
ktime_get_real_ts64(&ts);
|
||||
|
||||
raw_spin_lock_irqsave(&timekeeper_lock, flags);
|
||||
write_seqcount_begin(&tk_core.seq);
|
||||
|
||||
orig_tai = tai = tk->tai_offset;
|
||||
ret = __do_adjtimex(txc, &ts, &tai);
|
||||
ret = __do_adjtimex(txc, &ts, &tai, &ad);
|
||||
|
||||
if (tai != orig_tai) {
|
||||
__timekeeping_set_tai_offset(tk, tai);
|
||||
@@ -2341,6 +2350,8 @@ int do_adjtimex(struct __kernel_timex *txc)
|
||||
write_seqcount_end(&tk_core.seq);
|
||||
raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
|
||||
|
||||
audit_ntp_log(&ad);
|
||||
|
||||
/* Update the multiplier immediately if frequency was set directly */
|
||||
if (txc->modes & (ADJ_FREQUENCY | ADJ_TICK))
|
||||
timekeeping_advance(TK_ADV_FREQ);
|
||||
|
Reference in New Issue
Block a user