In commit fa516b6 ("EVM: Allow runtime modification of the set of verified
xattrs") support was added in the kernel for the
AUDIT_INTEGRITY_EVM_XATTR record with the EVM_ADD_XATTRS config option.
Its record number is 1806. It has a field "xattr=" with result field
"res=".
Add support for the record type number. Since the xattr field isn't
searchable, a parser wasn't necessary.
See: https://github.com/linux-audit/audit-userspace/issues/85
Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
---
auparse/normalize_record_map.h | 1 +
lib/libaudit.h | 3 +++
lib/msg_typetab.h | 1 +
3 files changed, 5 insertions(+)
diff --git a/auparse/normalize_record_map.h b/auparse/normalize_record_map.h
index 085437f67724..fee778e76db7 100644
--- a/auparse/normalize_record_map.h
+++ b/auparse/normalize_record_map.h
@@ -99,6 +99,7 @@ _S(AUDIT_ANOM_LINK, "used-suspcious-link")
//_S(AUDIT_INTEGRITY_HASH,"")
//_S(AUDIT_INTEGRITY_PCR,"")
//_S(AUDIT_INTEGRITY_RULE,"")
+//_S(AUDIT_INTEGRITY_EVM_XATTR,"")
_S(AUDIT_KERNEL, "initialized-audit-subsystem")
_S(AUDIT_ANOM_LOGIN_FAILURES, "failed-log-in-too-many-times-to")
_S(AUDIT_ANOM_LOGIN_TIME, "attempted-log-in-during-unusual-hour-to")
diff --git a/lib/libaudit.h b/lib/libaudit.h
index ca7aa63e354e..797e0a7be5a8 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -142,6 +142,9 @@ extern "C" {
#define AUDIT_INTEGRITY_PCR 1804 /* PCR invalidation msgs */
#define AUDIT_INTEGRITY_RULE 1805 /* Policy rule */
#endif
+#ifndef AUDIT_INTEGRITY_EVM_XATTR
+#define AUDIT_INTEGRITY_EVM_XATTR 1806 /* New EVM-covered xattr */
+#endif
#define AUDIT_FIRST_ANOM_MSG 2100
#define AUDIT_LAST_ANOM_MSG 2199
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index f5d76e4f38a1..af34c04c65d4 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -152,6 +152,7 @@ _S(AUDIT_INTEGRITY_STATUS, "INTEGRITY_STATUS" )
_S(AUDIT_INTEGRITY_HASH, "INTEGRITY_HASH" )
_S(AUDIT_INTEGRITY_PCR, "INTEGRITY_PCR" )
_S(AUDIT_INTEGRITY_RULE, "INTEGRITY_RULE" )
+_S(AUDIT_INTEGRITY_EVM_XATTR, "INTEGRITY_EVM_XATTR" )
#ifdef WITH_APPARMOR
_S(AUDIT_AA, "APPARMOR" )
--
1.8.3.1
