From ccec3aa9fda8483a2e0e0b9de6ba612f4bdcc314 Mon Sep 17 00:00:00 2001 From: Jeff Vander Stoep Date: Sat, 4 Apr 2015 16:15:54 -0700 Subject: security: lsm_audit: add ioctl specific auditing Add information about ioctl calls to the LSM audit data. Log the file path and command number. Bug: 18087110 Change-Id: Idbbd106db6226683cb30022d9e8f6f3b8fab7f84 Signed-off-by: Jeff Vander Stoep --- security/lsm_audit.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'security') diff --git a/security/lsm_audit.c b/security/lsm_audit.c index 893af8a..cb17791 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -240,6 +240,21 @@ static void dump_common_audit_data(struct audit_buffer *ab, inode->i_ino); break; } + case LSM_AUDIT_DATA_IOCTL_OP: { + struct inode *inode; + + audit_log_d_path(ab, " path=", &a->u.op->path); + + inode = a->u.op->path.dentry->d_inode; + if (inode) { + audit_log_format(ab, " dev="); + audit_log_untrustedstring(ab, inode->i_sb->s_id); + audit_log_format(ab, " ino=%lu", inode->i_ino); + } + + audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd); + break; + } case LSM_AUDIT_DATA_DENTRY: { struct inode *inode; -- cgit v1.1