Hello,
these patches add support for auditing uses of the AF_ALG protocol family
developed by Herbert Xu to provide user-space access to kernel crypto
accelerators.
One new record is defined: AUDIT_CRYPTO_USERSPACE_OP. An audited event
is always caused by a syscall, and all other syscall-related data
(process identity, syscall result) is audited in the usual records.
To disable auditing crypto by default and to allow the users to
selectively enable them using filters, a new filter field
AUDIT_CRYPTO_OP is defined; auditing of all crypto operations can
thus be enabled using (auditctl -a exit,always -F crypto_op!=0).
Changes since the previous version:
* Use audit_aux_data instead of a separate linked list
* Don't overwrite initial values of "err" by 0 in algif_skcipher.c
Mirek
Miloslav TrmaÄ (5):
Add general crypto auditing infrastructure
Add unique IDs to AF_ALG sockets
Add "alg_name" operation to af_alg_type.
Audit type-independent events
Audit type-specific crypto operations
crypto/af_alg.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++-
crypto/algif_hash.c | 35 +++++++++++++--
crypto/algif_skcipher.c | 28 +++++++++++-
include/crypto/if_alg.h | 17 +++++--
include/linux/audit.h | 22 +++++++++
kernel/auditfilter.c | 2 +
kernel/auditsc.c | 97 +++++++++++++++++++++++++++++++++++++++++
7 files changed, 296 insertions(+), 15 deletions(-)
--
1.7.3.2
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
