[redhat-lspp] [PATCH 1/2] audit: rename AUDIT_SE_* constants
Darrel Goeddel
dgoeddel at trustedcs.com
Thu Jun 29 21:56:39 UTC 2006
This patch renames some audit constant definitions and adds
additional definitions used by the following patch. The renaming
avoids ambiguity with respect to the new definitions.
Signed-off-by: Darrel Goeddel <dgoeddel at trustedcs.com>
include/linux/audit.h | 15 ++++++++----
kernel/auditfilter.c | 50 ++++++++++++++++++++---------------------
kernel/auditsc.c | 10 ++++----
security/selinux/ss/services.c | 32 +++++++++++++-------------
4 files changed, 56 insertions(+), 51 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index f7883ec..c5cbd4d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -152,12 +152,17 @@ #define AUDIT_LOGINUID 9
#define AUDIT_PERS 10
#define AUDIT_ARCH 11
#define AUDIT_MSGTYPE 12
-#define AUDIT_SE_USER 13 /* security label user */
-#define AUDIT_SE_ROLE 14 /* security label role */
-#define AUDIT_SE_TYPE 15 /* security label type */
-#define AUDIT_SE_SEN 16 /* security label sensitivity label */
-#define AUDIT_SE_CLR 17 /* security label clearance label */
+#define AUDIT_SUBJ_USER 13 /* security label user */
+#define AUDIT_SUBJ_ROLE 14 /* security label role */
+#define AUDIT_SUBJ_TYPE 15 /* security label type */
+#define AUDIT_SUBJ_SEN 16 /* security label sensitivity label */
+#define AUDIT_SUBJ_CLR 17 /* security label clearance label */
#define AUDIT_PPID 18
+#define AUDIT_OBJ_USER 19
+#define AUDIT_OBJ_ROLE 20
+#define AUDIT_OBJ_TYPE 21
+#define AUDIT_OBJ_LEV_LOW 22
+#define AUDIT_OBJ_LEV_HIGH 23
/* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index e98db08..40a9931 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -470,11 +470,11 @@ static struct audit_entry *audit_data_to
case AUDIT_ARG2:
case AUDIT_ARG3:
break;
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
str = audit_unpack_string(&bufp, &remain, f->val);
if (IS_ERR(str))
goto exit_free;
@@ -611,11 +611,11 @@ static struct audit_rule_data *audit_kru
data->fields[i] = f->type;
data->fieldflags[i] = f->op;
switch(f->type) {
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
data->buflen += data->values[i] =
audit_pack_string(&bufp, f->se_str);
break;
@@ -654,11 +654,11 @@ static int audit_compare_rule(struct aud
return 1;
switch(a->fields[i].type) {
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
return 1;
break;
@@ -774,11 +774,11 @@ static struct audit_entry *audit_dupe_ru
* the originals will all be freed when the old rule is freed. */
for (i = 0; i < fcount; i++) {
switch (new->fields[i].type) {
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
err = audit_dupe_selinux_field(&new->fields[i],
&old->fields[i]);
break;
@@ -1537,11 +1537,11 @@ static inline int audit_rule_has_selinux
for (i = 0; i < rule->field_count; i++) {
struct audit_field *f = &rule->fields[i];
switch (f->type) {
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
return 1;
}
}
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index b32ccfa..e183a6f 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -321,11 +321,11 @@ static int audit_filter_rules(struct tas
if (ctx)
result = audit_comparator(ctx->loginuid, f->op, f->val);
break;
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
/* NOTE: this may return negative values indicating
a temporary error. We simply treat this as a
match for now to avoid losing information that
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d82898c..112484f 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1855,15 +1855,15 @@ int selinux_audit_rule_init(u32 field, u
return -ENOTSUPP;
switch (field) {
- case AUDIT_SE_USER:
- case AUDIT_SE_ROLE:
- case AUDIT_SE_TYPE:
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
/* only 'equals' and 'not equals' fit user, role, and type */
if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)
return -EINVAL;
break;
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
/* we do not allow a range, indicated by the presense of '-' */
if (strchr(rulestr, '-'))
return -EINVAL;
@@ -1884,29 +1884,29 @@ int selinux_audit_rule_init(u32 field, u
tmprule->au_seqno = latest_granting;
switch (field) {
- case AUDIT_SE_USER:
+ case AUDIT_SUBJ_USER:
userdatum = hashtab_search(policydb.p_users.table, rulestr);
if (!userdatum)
rc = -EINVAL;
else
tmprule->au_ctxt.user = userdatum->value;
break;
- case AUDIT_SE_ROLE:
+ case AUDIT_SUBJ_ROLE:
roledatum = hashtab_search(policydb.p_roles.table, rulestr);
if (!roledatum)
rc = -EINVAL;
else
tmprule->au_ctxt.role = roledatum->value;
break;
- case AUDIT_SE_TYPE:
+ case AUDIT_SUBJ_TYPE:
typedatum = hashtab_search(policydb.p_types.table, rulestr);
if (!typedatum)
rc = -EINVAL;
else
tmprule->au_ctxt.type = typedatum->value;
break;
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
break;
}
@@ -1958,7 +1958,7 @@ int selinux_audit_rule_match(u32 ctxid,
/* a field/op pair that is not caught here will simply fall through
without a match */
switch (field) {
- case AUDIT_SE_USER:
+ case AUDIT_SUBJ_USER:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->user == rule->au_ctxt.user);
@@ -1968,7 +1968,7 @@ int selinux_audit_rule_match(u32 ctxid,
break;
}
break;
- case AUDIT_SE_ROLE:
+ case AUDIT_SUBJ_ROLE:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->role == rule->au_ctxt.role);
@@ -1978,7 +1978,7 @@ int selinux_audit_rule_match(u32 ctxid,
break;
}
break;
- case AUDIT_SE_TYPE:
+ case AUDIT_SUBJ_TYPE:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->type == rule->au_ctxt.type);
@@ -1988,9 +1988,9 @@ int selinux_audit_rule_match(u32 ctxid,
break;
}
break;
- case AUDIT_SE_SEN:
- case AUDIT_SE_CLR:
- level = (field == AUDIT_SE_SEN ?
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
+ level = (field == AUDIT_SUBJ_SEN ?
&ctxt->range.level[0] : &ctxt->range.level[1]);
switch (op) {
case AUDIT_EQUAL:
--
Darrel
More information about the redhat-lspp
mailing list