[PATCH v3 1/7] add basic support for the AUDIT_URINGOP record type

Richard Guy Briggs rgb at redhat.com
Thu Oct 28 19:59:33 UTC 2021


Kernel support to audit io_uring operations was added with commit
5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to
io_uring").  Add basic support to recognize the "AUDIT_URINGOP" record.

Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
---
 lib/libaudit.h    | 4 ++++
 lib/msg_typetab.h | 1 +
 2 files changed, 5 insertions(+)

diff --git a/lib/libaudit.h b/lib/libaudit.h
index 4e532177aa11..08b7d22678aa 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -307,6 +307,10 @@ extern "C" {
 #define AUDIT_EVENT_LISTENER	1335 /* audit mcast sock join/part */
 #endif
 
+#ifndef AUDIT_URINGOP
+#define AUDIT_URINGOP		1336 /* io_uring operations */
+#endif
+
 #ifndef AUDIT_OPENAT2
 #define AUDIT_OPENAT2		1337 /* openat2 open_how flags */
 #endif
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index 030b1952f2cb..f8ae4514893b 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -127,6 +127,7 @@ _S(AUDIT_TIME_INJOFFSET,             "TIME_INJOFFSET"                )
 _S(AUDIT_TIME_ADJNTPVAL,             "TIME_ADJNTPVAL"                )
 _S(AUDIT_BPF,                        "BPF"                           )
 _S(AUDIT_EVENT_LISTENER,             "EVENT_LISTENER"                )
+_S(AUDIT_URINGOP,                    "URINGOP"                       )
 _S(AUDIT_OPENAT2,                    "OPENAT2"                       )
 _S(AUDIT_AVC,                        "AVC"                           )
 _S(AUDIT_SELINUX_ERR,                "SELINUX_ERR"                   )
-- 
2.27.0




More information about the Linux-audit mailing list