Kernel support to audit io_uring operations was added with commit
5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to
io_uring"). Add basic support to recognize the "AUDIT_URINGOP" record.
Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
---
lib/libaudit.h | 4 ++++
lib/msg_typetab.h | 1 +
2 files changed, 5 insertions(+)
diff --git a/lib/libaudit.h b/lib/libaudit.h
index 4e532177aa11..08b7d22678aa 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -307,6 +307,10 @@ extern "C" {
#define AUDIT_EVENT_LISTENER 1335 /* audit mcast sock join/part */
#endif
+#ifndef AUDIT_URINGOP
+#define AUDIT_URINGOP 1336 /* io_uring operations */
+#endif
+
#ifndef AUDIT_OPENAT2
#define AUDIT_OPENAT2 1337 /* openat2 open_how flags */
#endif
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index 030b1952f2cb..f8ae4514893b 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -127,6 +127,7 @@ _S(AUDIT_TIME_INJOFFSET, "TIME_INJOFFSET" )
_S(AUDIT_TIME_ADJNTPVAL, "TIME_ADJNTPVAL" )
_S(AUDIT_BPF, "BPF" )
_S(AUDIT_EVENT_LISTENER, "EVENT_LISTENER" )
+_S(AUDIT_URINGOP, "URINGOP" )
_S(AUDIT_OPENAT2, "OPENAT2" )
_S(AUDIT_AVC, "AVC" )
_S(AUDIT_SELINUX_ERR, "SELINUX_ERR" )
--
2.27.0
