[PATCH v6] audit: log AUDIT_TIME_* records only from rules

[Paul Moore]

On Tue, Feb 22, 2022 at 11:45 AM Richard Guy Briggs <rgb at redhat.com> wrote:
>
> AUDIT_TIME_* events are generated when there are syscall rules present
> that are not related to time keeping.  This will produce noisy log
> entries that could flood the logs and hide events we really care about.
>
> Rather than immediately produce the AUDIT_TIME_* records, store the data
> in the context and log it at syscall exit time respecting the filter
> rules.
>
> Note: This eats the audit_buffer, unlike any others in show_special().
>
> Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
>
> Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
> Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
> Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> ---
> Changelog:
> v2:
> - rename __audit_ntp_log_ to audit_log_ntp
> - pre-check ntp before storing
> - move tk out of the context union and move ntp logging to the bottom of audit_show_special()
> - restructure logging of ntp to use ab and allocate more only if more
> - add Fixes lines
> v3
> - move tk into union
> - rename audit_log_ntp() to audit_log_time() and add tk
> - key off both AUDIT_TIME_* but favour NTP
> v4
> - drop tk goto in favour of ntp if clause
> - add comments to clarify calling function buffer expectations
> v5
> - hold my nose and swallow the audit_buffer in audit_log_time()
> v6
> - declare audit_log_time() and ntp_name as static
>
>  kernel/audit.h   |  4 +++
>  kernel/auditsc.c | 85 ++++++++++++++++++++++++++++++++++++------------
>  2 files changed, 69 insertions(+), 20 deletions(-)

Merged into audit/next.

-- 
paul-moore.com