Home
last modified time | relevance | path

Searched refs:audit (Results 1 – 25 of 59) sorted by relevance

123

/linux/tools/perf/scripts/python/Perf-Trace-Util/lib/Perf/Trace/
H A DUtil.py54 import audit
56 'x86_64': audit.MACH_86_64,
57 'aarch64': audit.MACH_AARCH64,
58 'alpha' : audit.MACH_ALPHA,
59 'ia64' : audit.MACH_IA64,
60 'ppc' : audit.MACH_PPC,
61 'ppc64' : audit.MACH_PPC64,
62 'ppc64le' : audit.MACH_PPC64LE,
63 's390' : audit.MACH_S390,
64 's390x' : audit.MACH_S390X,
[all …]
/linux/Documentation/ABI/stable/
H A Dprocfs-audit_loginuid3 KernelVersion: 2.6.11-rc2 1e2d1492e178 ("[PATCH] audit: handle loginuid through proc")
4 Contact: linux-audit@redhat.com
5 Users: audit and login applications
8 read to get the audit login UID of process $pid as a
20 Contact: linux-audit@redhat.com
21 Users: audit and login applications
24 audit login session ID of process $pid as a decimal
/linux/security/landlock/
H A Dtrace.c105 switch (request->audit.type) { in landlock_trace_denial()
107 path = &request->audit.u.file->f_path; in landlock_trace_denial()
110 path = &request->audit.u.op->path; in landlock_trace_denial()
119 .dentry = request->audit.u.dentry, in landlock_trace_denial()
124 path = &request->audit.u.path; in landlock_trace_denial()
129 request->audit.type); in landlock_trace_denial()
138 } else if (request->audit.type == in landlock_trace_denial()
142 request->audit.u.dentry, buf, PATH_MAX); in landlock_trace_denial()
183 request->audit.u.net->sk, in landlock_trace_denial()
200 request->audit.u.tsk, trace_ptrace->tracer); in landlock_trace_denial()
[all …]
H A Dtask.c121 .audit = { in hook_ptrace_access_check()
172 .audit = { in hook_ptrace_traceme()
333 .audit = { in hook_unix_stream_connect()
373 .audit = { in hook_unix_may_send()
442 .audit = { in hook_task_kill()
508 .audit = { in hook_file_send_sigiotask()
H A Dnet.c143 .audit.type = in current_check_access_socket()
145 .audit.u.net = &audit_net, in current_check_access_socket()
293 .audit.type = LSM_AUDIT_DATA_NET, in current_check_access_socket()
294 .audit.u.net = &audit_net, in current_check_access_socket()
H A Dfs.c1012 log_request_parent1->audit.type = LSM_AUDIT_DATA_PATH; in is_access_to_paths_allowed()
1013 log_request_parent1->audit.u.path = *path; in is_access_to_paths_allowed()
1020 log_request_parent2->audit.type = LSM_AUDIT_DATA_PATH; in is_access_to_paths_allowed()
1021 log_request_parent2->audit.u.path = *path; in is_access_to_paths_allowed()
1336 request1.audit.u.path.dentry = old_parent; in current_check_refer_path()
1340 request2.audit.u.path.dentry = new_dir->dentry; in current_check_refer_path()
1493 .audit = { in log_fs_change_topology_path()
1507 .audit = { in log_fs_change_topology_dentry()
1945 .audit = { in hook_file_truncate()
1982 .audit = { in hook_file_ioctl_common()
H A Dlog.h63 struct common_audit_data audit; member
/linux/arch/x86/ia32/
H A DMakefile6 audit-class-$(CONFIG_AUDIT) := audit.o
7 obj-$(CONFIG_IA32_EMULATION) += $(audit-class-y)
/linux/security/apparmor/
H A Ddomain.c297 perms->audit = perms->quiet = perms->kill = 0; in change_profile_perms()
694 goto audit; in profile_transition()
709 perms.audit |= MAY_EXEC; in profile_transition()
737 perms.audit |= MAY_EXEC; in profile_transition()
739 goto audit; in profile_transition()
773 goto audit; in profile_transition()
786 audit: in profile_transition()
834 goto audit; in profile_onexec()
841 goto audit; in profile_onexec()
852 goto audit; in profile_onexec()
[all …]
H A Dfile.c120 u32 mask = perms->audit; in aa_audit_file()
349 goto audit; in profile_path_link()
356 goto audit; in profile_path_link()
365 goto audit; in profile_path_link()
374 lperms.audit = perms.audit; in profile_path_link()
381 goto audit; in profile_path_link()
400 goto audit; in profile_path_link()
406 goto audit; in profile_path_link()
412 audit: in profile_path_link()
H A Dpolicy_compat.c118 perms.audit = map_old_perms(dfa_user_audit(dfa, state)); in compute_fperms_user()
133 perms.audit = map_old_perms(dfa_other_audit(dfa, state)); in compute_fperms_other()
217 perms.audit = dfa_user_audit(dfa, state); in compute_perms_entry()
241 perms.audit |= map_other(dfa_other_audit(dfa, state)); in compute_perms_entry()
271 table[state].prompt, table[state].audit, in compute_perms()
H A Dlib.c376 perms->audit = ALL_PERMS_MASK; in aa_apply_modes_to_perms()
382 perms->audit = 0; in aa_apply_modes_to_perms()
434 request &= perms->audit; in aa_check_perms()
/linux/security/integrity/
H A Dintegrity_audit.c12 #include <linux/audit.h>
20 unsigned long audit; in integrity_audit_setup() local
22 if (!kstrtoul(str, 0, &audit)) in integrity_audit_setup()
23 integrity_audit_info = audit ? 1 : 0; in integrity_audit_setup()
/linux/security/apparmor/include/
H A Dperms.h80 u32 audit; /* set only when allow is set */ member
112 accum->audit |= addend->audit & addend->allow; in aa_perms_accum_raw()
139 accum->audit |= addend->audit & accum->allow; in aa_perms_accum()
H A Dcapability.h31 kernel_cap_t audit; member
H A Dpolicy.h264 enum audit_mode audit; member
444 return profile->audit; in AUDIT_MODE()
/linux/security/tomoyo/
H A DKconfig30 int "Default maximal count for audit log"
36 audit logs that the kernel can hold on memory.
37 You can read the log via /sys/kernel/security/tomoyo/audit.
38 If you don't need audit logs, you may set this value to 0.
H A DMakefile4 obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
/linux/Documentation/trace/
H A Devents-landlock.rst21 Landlock trace events, like audit records, expose sensitive
100 Here ``logged=0`` shows that audit would not record this cross-execution
104 Differences from audit records
107 Tracepoints and audit records both log Landlock denials, but differ
123 tracepoints use the ``blockers=`` field name (same as audit). Both
124 render the blocked access rights as names: audit prefixes the category
134 because the audit log format is not event-type-specific.
308 ``audit_enabled`` toggle, so it does not change when audit is turned on
309 or off. When audit is enabled, ``logged==1`` selects the denials the
310 domain submits to audit (audit-side rate-limiting and exclude rules may
[all …]
/linux/tools/testing/selftests/landlock/
H A Dptrace_test.c23 #include "audit.h"
315 FIXTURE(audit) in FIXTURE()
321 FIXTURE_SETUP(audit) in FIXTURE_SETUP()
330 FIXTURE_TEARDOWN_PARENT(audit) in FIXTURE_TEARDOWN_PARENT()
336 TEST_F(audit, trace) in TEST_F()
312 FIXTURE(audit) FIXTURE() argument
318 FIXTURE_SETUP(audit) FIXTURE_SETUP() argument
327 FIXTURE_TEARDOWN_PARENT(audit) FIXTURE_TEARDOWN_PARENT() argument
333 TEST_F(audit,trace) TEST_F() argument
H A Daudit_test.c21 #include "audit.h"
41 FIXTURE(audit) in FIXTURE() argument
47 FIXTURE_SETUP(audit) in FIXTURE_SETUP() argument
61 TH_LOG("Failed to initialize audit: %s", error_msg); in FIXTURE_SETUP()
66 FIXTURE_TEARDOWN(audit) in FIXTURE_TEARDOWN() argument
73 TEST_F(audit, layers) in TEST_F() argument
208 /* Waits for the parent to update audit filters. */ in thread_audit_test()
221 TEST_F(audit, thread) in TEST_F()
292 TEST_F(audit, log_subdomains_off_fork) in FIXTURE_VARIANT()
309 * before any muting. This proves the audit pat in FIXTURE_VARIANT_ADD()
219 TEST_F(audit,thread) TEST_F() argument
[all...]
/linux/Documentation/admin-guide/LSM/
H A Dipe.rst132 generates audit logs which may be utilized to detect and analyze failures
350 …type=1420 audit(1653364370.067:61): ipe_op=EXECUTE ipe_hook=MMAP enforcing=1 pid=2241 comm="ld-lin…
351 …type=1300 audit(1653364370.067:61): SYSCALL arch=c000003e syscall=9 success=no exit=-13 a0=7f1105a…
352 type=1327 audit(1653364370.067:61): 707974686F6E3300746573742F6D61696E2E7079002D6E00
354 …type=1420 audit(1653364735.161:64): ipe_op=EXECUTE ipe_hook=MMAP enforcing=1 pid=2472 comm="mmap_t…
355 …type=1300 audit(1653364735.161:64): SYSCALL arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=10…
356 type=1327 audit(1653364735.161:64): 707974686F6E3300746573742F6D61696E2E7079002D6E00
395 …type=1421 audit(1653425583.136:54): old_active_pol_name="Allow_All" old_active_pol_version=0.0.0 o…
396 …type=1300 audit(1653425583.136:54): SYSCALL arch=c000003e syscall=1 success=yes exit=2 a0=3 a1=559…
397 …type=1327 audit(1653425583.136:54): PROCTITLE proctitle=707974686F6E3300746573742F6D61696E2E707900…
[all …]
/linux/tools/perf/Documentation/
H A Dsecurity.txt140 monitoring and observability operations. Inspect system audit records for
155 audit records using journalctl command or /var/log/audit/audit.log so the
163 …audit[1318098]: AVC avc: denied { open } for pid=1318098 comm="perf" scontext=unconfined_u:unco…
168 be generated using the system audit records about blocking perf_event access.
/linux/drivers/comedi/
H A DTODO5 - audit userspace interface
/linux/security/ipe/
H A DMakefile26 audit.o \

123