Commit 3c66251e authored by Al Viro's avatar Al Viro

[PATCH] add filtering by ppid

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent f46038ff
...@@ -152,6 +152,7 @@ ...@@ -152,6 +152,7 @@
#define AUDIT_SE_TYPE 15 /* security label type */ #define AUDIT_SE_TYPE 15 /* security label type */
#define AUDIT_SE_SEN 16 /* security label sensitivity label */ #define AUDIT_SE_SEN 16 /* security label sensitivity label */
#define AUDIT_SE_CLR 17 /* security label clearance label */ #define AUDIT_SE_CLR 17 /* security label clearance label */
#define AUDIT_PPID 18
/* These are ONLY useful when checking /* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */ * at syscall exit time (AUDIT_AT_EXIT). */
......
...@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk, ...@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk,
case AUDIT_PID: case AUDIT_PID:
result = audit_comparator(tsk->pid, f->op, f->val); result = audit_comparator(tsk->pid, f->op, f->val);
break; break;
case AUDIT_PPID:
if (ctx)
result = audit_comparator(ctx->ppid, f->op, f->val);
break;
case AUDIT_UID: case AUDIT_UID:
result = audit_comparator(tsk->uid, f->op, f->val); result = audit_comparator(tsk->uid, f->op, f->val);
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment