1. 20 Oct, 2014 39 commits
  2. 19 Oct, 2014 1 commit
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/users/eparis/audit · ab074ade
      Linus Torvalds authored
      Pull audit updates from Eric Paris:
       "So this change across a whole bunch of arches really solves one basic
        problem.  We want to audit when seccomp is killing a process.  seccomp
        hooks in before the audit syscall entry code.  audit_syscall_entry
        took as an argument the arch of the given syscall.  Since the arch is
        part of what makes a syscall number meaningful it's an important part
        of the record, but it isn't available when seccomp shoots the
        syscall...
      
        For most arch's we have a better way to get the arch (syscall_get_arch)
        So the solution was two fold: Implement syscall_get_arch() everywhere
        there is audit which didn't have it.  Use syscall_get_arch() in the
        seccomp audit code.  Having syscall_get_arch() everywhere meant it was
        a useless flag on the stack and we could get rid of it for the typical
        syscall entry.
      
        The other changes inside the audit system aren't grand, fixed some
        records that had invalid spaces.  Better locking around the task comm
        field.  Removing some dead functions and structs.  Make some things
        static.  Really minor stuff"
      
      * git://git.infradead.org/users/eparis/audit: (31 commits)
        audit: rename audit_log_remove_rule to disambiguate for trees
        audit: cull redundancy in audit_rule_change
        audit: WARN if audit_rule_change called illegally
        audit: put rule existence check in canonical order
        next: openrisc: Fix build
        audit: get comm using lock to avoid race in string printing
        audit: remove open_arg() function that is never used
        audit: correct AUDIT_GET_FEATURE return message type
        audit: set nlmsg_len for multicast messages.
        audit: use union for audit_field values since they are mutually exclusive
        audit: invalid op= values for rules
        audit: use atomic_t to simplify audit_serial()
        kernel/audit.c: use ARRAY_SIZE instead of sizeof/sizeof[0]
        audit: reduce scope of audit_log_fcaps
        audit: reduce scope of audit_net_id
        audit: arm64: Remove the audit arch argument to audit_syscall_entry
        arm64: audit: Add audit hook in syscall_trace_enter/exit()
        audit: x86: drop arch from __audit_syscall_entry() interface
        sparc: implement is_32bit_task
        sparc: properly conditionalize use of TIF_32BIT
        ...
      ab074ade