On Wed, Apr 22, 2020 at 5:40 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote: > > NETFILTER_CFG record generation was inconsistent for x_tables and > ebtables configuration changes. The call was needlessly messy and there > were supporting records missing at times while they were produced when > not requested. Simplify the logging call into a new audit_log_nfcfg > call. Honour the audit_enabled setting while more consistently > recording information including supporting records by tidying up dummy > checks. > > Add an op= field that indicates the operation being performed (register > or replace). > > Here is the enhanced sample record: > type=NETFILTER_CFG msg=audit(1580905834.919:82970): table=filter family=2 entries=83 op=replace > > Generate audit NETFILTER_CFG records on ebtables table registration. > Previously this was being done for x_tables registration and replacement > operations and ebtables table replacement only. > > See: https://github.com/linux-audit/audit-kernel/issues/25 > See: https://github.com/linux-audit/audit-kernel/issues/35 > See: https://github.com/linux-audit/audit-kernel/issues/43 > > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx> > --- > include/linux/audit.h | 21 +++++++++++++++++++++ > kernel/auditsc.c | 24 ++++++++++++++++++++++++ > net/bridge/netfilter/ebtables.c | 12 ++++-------- > net/netfilter/x_tables.c | 12 +++--------- > 4 files changed, 52 insertions(+), 17 deletions(-) Merged into audit/next, thanks. -- paul moore www.paul-moore.com
