[RFC PATCH ghak10 3/3] ntp: Audit valid attempts to adjust the clock

[Ondrej Mosnacek]

(Intentionally not sending to the timekeeping/ntp maintainers just yet,
let's settle on the record contents/format first.)

Signed-off-by: Ondrej Mosnacek <omosnace at redhat.com>
---
 kernel/time/ntp.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index a09ded765f6c..78a01df0dbdb 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/rtc.h>
 #include <linux/math64.h>
+#include <linux/audit.h>
 
 #include "ntp_internal.h"
 #include "timekeeping_internal.h"
@@ -722,6 +723,16 @@ int __do_adjtimex(struct timex *txc, struct timespec64 *ts, s32 *time_tai)
 {
 	int result;
 
+	/* Only log audit event if the clock was changed/attempted to be changed.
+	 * Based on the logic inside timekeeping_validate_timex().
+	 * NOTE: We need to log the event before any of the fields get
+	 * overwritten by the output values (the function will not fail, so it
+	 * is OK). */
+	if (   ( (txc->modes & ADJ_ADJTIME) && !(txc->modes & ADJ_OFFSET_READONLY))
+	    || (!(txc->modes & ADJ_ADJTIME) &&   txc->modes)
+	    ||   (txc->modes & ADJ_SETOFFSET))
+		audit_adjtime(txc);
+
 	if (txc->modes & ADJ_ADJTIME) {
 		long save_adjust = time_adjust;
 
-- 
2.17.1