From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mr Dash Four Subject: [PATCH 4/4] AUDIT: add SELinux support Date: Thu, 26 May 2011 00:43:15 +0100 Message-ID: <4DDD9413.9030407@googlemail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id p4PNhHfo002052 for ; Wed, 25 May 2011 19:43:17 -0400 Received: from mail-wy0-f174.google.com (mail-wy0-f174.google.com [74.125.82.174]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p4PNh26X028457 for ; Wed, 25 May 2011 19:43:16 -0400 Received: by mail-wy0-f174.google.com with SMTP id 21so180188wya.33 for ; Wed, 25 May 2011 16:43:16 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux-audit List-Id: linux-audit@redhat.com Add SELinux context support to the AUDIT target and enable SELinux context reporting on AUDITed packet(s). Signed-off-by: Mr Dash Four --- net/netfilter/xt_AUDIT.c | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index f17a0e4..c727215 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -20,6 +20,9 @@ #include #include #include +#ifdef CONFIG_NF_CONNTRACK_SECMARK +#include +#endif #ifdef CONFIG_IPV6 #include #endif @@ -130,6 +133,10 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_audit_info *info = par->targinfo; struct audit_buffer *ab; +#ifdef CONFIG_NF_CONNTRACK_SECMARK + u32 len; + char *secctx; +#endif ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) @@ -143,6 +150,14 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) if (skb->mark) audit_log_format(ab, " mark=%#x", skb->mark); +#ifdef CONFIG_NF_CONNTRACK_SECMARK + if (skb->secmark) + if (!security_secid_to_secctx(skb->secmark, &secctx, &len)) { + audit_log_format(ab, " obj=%s", secctx); + security_release_secctx(secctx, len); + } +#endif + if (skb->dev && skb->dev->type == ARPHRD_ETHER) { audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, -- 1.7.3.4