[PATCH 0/2] add support for more fields to the exclude filter

Richard Guy Briggs rgb at redhat.com
Wed Jun 1 22:58:07 UTC 2016


When support for avoiding in-band signals to indicate an unset loginuid
was added to the kernel, userspace was neglected, so add them here as a
prerequisite to enable their use in the exclude filter:
	See upstream kernel commits:
	780a7654cee8d61819512385e778e4827db4bfbc
	041d7b98ffe59c59fdd639931dea7d74f9aa9a59

The rest to support additional fields for the exclude filter is in the
second patch.

	RFE: add additional fields for use in audit filter exclude rules
	https://github.com/linux-audit/audit-kernel/issues/5

Richard Guy Briggs (2):
  add support for loginuid_set using macro AUDIT_LOGINUID_SET
  exclude filter: add support for user filter fields

 docs/auditctl.8 |    2 +-
 lib/fieldtab.h  |    2 ++
 lib/libaudit.c  |   21 ++++++++++++++++++---
 3 files changed, 21 insertions(+), 4 deletions(-)




More information about the Linux-audit mailing list