• Paul Moore's avatar
    audit: add filtering for io_uring records · 67daf270
    Paul Moore authored
    This patch adds basic audit io_uring filtering, using as much of the
    existing audit filtering infrastructure as possible.  In order to do
    this we reuse the audit filter rule's syscall mask for the io_uring
    operation and we create a new filter for io_uring operations as
    AUDIT_FILTER_URING_EXIT/audit_filter_list[7].
    
    Thanks to Richard Guy Briggs for his review, feedback, and work on
    the corresponding audit userspace changes.
    Acked-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    67daf270
audit_watch.c 13.7 KB