On Tue, 2024-12-10 at 17:34 +0100, Mickaël Salaün wrote: > > > > +++ b/include/uapi/linux/audit.h > > > > @@ -161,6 +161,7 @@ > > > > #define AUDIT_INTEGRITY_RULE 1805 /* policy rule */ > > > > #define AUDIT_INTEGRITY_EVM_XATTR 1806 /* New EVM-covered xattr */ > > > > #define AUDIT_INTEGRITY_POLICY_RULE 1807 /* IMA policy rules */ > > > > +#define AUDIT_INTEGRITY_DATA_CHECK 1808 /* Userspace enforced data integrity */ > > > > > > I worry that "DATA_CHECK" is a bit vague, should we change the name so > > > that there is some hint of either userspace enforcement or > > > AT_EXECVE_CHECK? > > > > > > What about AUDIT_INTEGRITY_DATA_USER? > > > > The emphasis should be on userspace - AUDIT_INTEGRITY_USERSPACE. > > Looks good, I'll send a new patch series with this change, following > https://lore.kernel.org/all/20241205160925.230119-9-mic@xxxxxxxxxxx/ Sound good! Thank you. Mimi
