archive mirror
 help / color / mirror / Atom feed
* [PATCH] tests/io_uring: set a filter for the io_uring ops we want to catch
@ 2023-03-17 20:48 Paul Moore
  0 siblings, 0 replies; only message in thread
From: Paul Moore @ 2023-03-17 20:48 UTC (permalink / raw)
  To: audit

Without an explicit io_uring filter in place, we might miss the
io_uring operation if it happens asynchronously.

See the post below for more information, examples, etc.:

Signed-off-by: Paul Moore <>
 tests/io_uring/test | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/io_uring/test b/tests/io_uring/test
index 9eb427a..df13af0 100755
--- a/tests/io_uring/test
+++ b/tests/io_uring/test
@@ -49,6 +49,7 @@ system("auditctl -D >& /dev/null");
 # set our io_uring filters
 system("auditctl -a exit,always -F arch=b$abi_bits -S io_uring_setup -k $key");
 system("auditctl -a exit,always -F arch=b$abi_bits -S io_uring_enter -k $key");
+system("auditctl -a io_uring,always -S openat -k $key");
 # run the "t1" test
 system("$basedir/iouring t1");

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2023-03-17 20:48 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-17 20:48 [PATCH] tests/io_uring: set a filter for the io_uring ops we want to catch Paul Moore

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).