Eric Paris
16c174bd95
audit: check current inode and containing object when filtering on major and minor
...
The audit system has the ability to filter on the major and minor number of
the device containing the inode being operated upon. Lets say that
/dev/sda1 has major,minor 8,1 and that we mount /dev/sda1 on /boot. Now lets
say we add a watch with a filter on 8,1. If we proceed to open an inode
inside /boot, such as /vboot/vmlinuz, we will match the major,minor filter.
Lets instead assume that one were to use a tool like debugfs and were to
open /dev/sda1 directly and to modify it's contents. We might hope that
this would also be logged, but it isn't. The rules will check the
major,minor of the device containing /dev/sda1. In other words the rule
would match on the major/minor of the tmpfs mounted at /dev.
I believe these rules should trigger on either device. The man page is
devoid of useful information about the intended semantics. It only seems
logical that if you want to know everything that happened on a major,minor
that would include things that happened to the device itself...
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-01-17 16:16:55 -05:00
..
debug
kdb: Make KDB use the new is_idle_task() API
2011-12-11 10:31:52 -08:00
events
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
gcov
gcov: disable CONSTRUCTORS for UML
2011-07-26 16:49:45 -07:00
irq
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2012-01-08 13:21:22 -08:00
power
PM/Hibernate: do not count debug pages as savable
2012-01-10 16:30:42 -08:00
sched
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
time
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2012-01-08 13:21:22 -08:00
trace
Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-01-08 12:19:57 -08:00
.gitignore
acct.c
Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-01-08 12:19:57 -08:00
async.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
audit.c
audit: drop the meaningless and format breaking word 'user'
2012-01-17 16:16:54 -05:00
audit.h
audit_tree.c
audit_tree,rcu: Convert call_rcu(__put_tree) to kfree_rcu()
2011-07-20 14:10:11 -07:00
audit_watch.c
auditfilter.c
audit: make filetype matching consistent with other filters
2012-01-17 16:16:54 -05:00
auditsc.c
audit: check current inode and containing object when filtering on major and minor
2012-01-17 16:16:55 -05:00
backtracetest.c
bounds.c
memcg: remove direct page_cgroup-to-page pointer
2011-03-23 19:46:28 -07:00
capability.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
cgroup.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
cgroup_freezer.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
compat.c
kernel: Fix files explicitly needing EXPORT_SYMBOL infrastructure
2011-10-31 19:30:05 -04:00
configs.c
kernel/configs.c: include MODULE_*() when CONFIG_IKCONFIG_PROC=n
2011-07-25 20:57:15 -07:00
cpu.c
Merge branch 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2012-01-08 13:10:57 -08:00
cpu_pm.c
cpu_pm: call notifiers during suspend
2011-09-23 12:05:29 +05:30
cpuset.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
crash_dump.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
cred.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
delayacct.c
KVM: Steal time implementation
2011-07-14 12:59:14 +03:00
dma.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
elfcore.c
exec_domain.c
exit.c
Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux
2012-01-10 16:59:59 -08:00
extable.c
extable, core_kernel_data(): Make sure all archs define _sdata
2011-05-20 08:56:56 +02:00
fork.c
Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux
2012-01-10 16:59:59 -08:00
freezer.c
freezer: kill unused set_freezable_with_signal()
2011-11-23 09:28:17 -08:00
futex.c
futex: Fix uninterruptible loop due to gate_area
2011-12-31 11:48:28 -08:00
futex_compat.c
userns: user namespaces: convert several capable() calls
2011-03-23 19:47:08 -07:00
groups.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
hrtimer.c
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2011-11-28 08:43:52 -08:00
hung_task.c
hung_task: fix false positive during vfork
2012-01-03 16:14:32 -08:00
irq_work.c
kernel: fix two implicit header assumptions in irq_work.c
2011-10-31 09:20:12 -04:00
itimer.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
jump_label.c
Merge remote-tracking branch 'tip/perf/core' into kvm-updates/3.3
2011-12-27 11:22:24 +02:00
kallsyms.c
Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2011-03-25 17:52:22 -07:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
arch:Kconfig.locks Remove unused config option.
2011-04-10 17:01:05 +02:00
Kconfig.preempt
sched: Isolate preempt counting in its own config option
2011-06-10 15:15:40 +02:00
kexec.c
PM / Sleep: Replace mutex_[un]lock(&pm_mutex) with [un]lock_system_sleep()
2011-12-08 23:22:29 +01:00
kfifo.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
kmod.c
Merge branch 'pm-sleep' into pm-for-linus
2011-12-25 23:42:20 +01:00
kprobes.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
ksysfs.c
kernel: ksysfs.c is implicitly using stat.h
2011-10-31 09:20:13 -04:00
kthread.c
freezer: kill unused set_freezable_with_signal()
2011-11-23 09:28:17 -08:00
latencytop.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
lockdep.c
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-01-06 08:02:58 -08:00
lockdep_internals.h
lockdep_proc.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
lockdep_states.h
Makefile
sched: Move all scheduler bits into kernel/sched/
2011-11-17 12:20:22 +01:00
module.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
mutex-debug.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
mutex-debug.h
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
mutex.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
mutex.h
mutex: Use p->on_cpu for the adaptive spin
2011-04-14 08:52:33 +02:00
notifier.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
nsproxy.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
padata.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
panic.c
lockdep, bug: Exclude TAINT_OOT_MODULE from disabling lock debugging
2011-12-07 23:32:10 +01:00
params.c
kernel: params.c needs module.h not moduleparam.h
2011-10-31 09:20:13 -04:00
pid.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
pid_namespace.c
pidns: call pid_ns_prepare_proc() from create_pid_namespace()
2011-03-23 19:46:58 -07:00
posix-cpu-timers.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
posix-timers.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
printk.c
Merge branch 'core-printk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-01-06 08:01:59 -08:00
profile.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
ptrace.c
ptrace: ensure JOBCTL_STOP_SIGMASK is not zero after detach
2012-01-04 15:01:59 -08:00
range.c
range: fix bogus misuse of module.h to get printk()
2011-10-31 09:20:11 -04:00
rcu.h
rcu: Deconfuse dynticks entry-exit tracing
2011-12-11 10:31:42 -08:00
rcupdate.c
rcu: Detect illegal rcu dereference in extended quiescent state
2011-12-11 10:31:30 -08:00
rcutiny.c
rcu: Augment rcu_batch_end tracing for idle and callback state
2011-12-11 10:32:22 -08:00
rcutiny_plugin.h
rcu: Apply ACCESS_ONCE() to rcu_boost() return value
2011-12-11 10:33:19 -08:00
rcutorture.c
rcu: Add rcutorture tests for srcu_read_lock_raw()
2011-12-11 10:32:21 -08:00
rcutree.c
rcu: Augment rcu_batch_end tracing for idle and callback state
2011-12-11 10:32:22 -08:00
rcutree.h
rcu: Keep invoking callbacks if CPU otherwise idle
2011-12-11 10:32:09 -08:00
rcutree_plugin.h
rcu: Apply ACCESS_ONCE() to rcu_boost() return value
2011-12-11 10:33:19 -08:00
rcutree_trace.c
rcu: Track idleness independent of idle tasks
2011-12-11 10:31:24 -08:00
relay.c
switch debugfs to umode_t
2012-01-03 22:54:56 -05:00
res_counter.c
resource cgroups: remove bogus cast
2011-12-13 07:43:08 -08:00
resource.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
rtmutex-debug.c
lockdep, rtmutex, bug: Show taint flags on error
2011-12-06 08:16:49 +01:00
rtmutex-debug.h
rtmutex-tester.c
rtmutex-tester: convert sysdev_class to a regular subsystem
2011-12-14 14:54:22 -08:00
rtmutex.c
Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"
2011-12-11 10:33:18 -08:00
rtmutex.h
rtmutex_common.h
rwsem.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
seccomp.c
semaphore.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
signal.c
user namespace: make signal.c respect user namespaces
2012-01-10 16:30:54 -08:00
smp.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
softirq.c
rcu: Fix early call to rcu_idle_enter()
2011-12-11 10:31:38 -08:00
spinlock.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
srcu.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
stacktrace.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
stop_machine.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
sys.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
sys_ni.c
Cross Memory Attach
2011-10-31 17:30:44 -07:00
sysctl.c
x86: Panic on detection of stack overflow
2011-12-05 11:37:47 +01:00
sysctl_binary.c
binary_sysctl(): fix memory leak
2011-12-20 10:25:04 -08:00
sysctl_check.c
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
taskstats.c
Make TASKSTATS require root access
2011-09-19 17:04:37 -07:00
test_kprobes.c
time.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
timeconst.pl
timer.c
Merge branch 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-01-06 07:53:34 -08:00
tracepoint.c
Tracepoint: Dissociate from module mutex
2011-08-10 20:38:14 -04:00
tsacct.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
uid16.c
userns: user namespaces: convert several capable() calls
2011-03-23 19:47:08 -07:00
up.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user-return-notifier.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user_namespace.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
utsname.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
utsname_sysctl.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
wait.c
lockdep/waitqueues: Add better annotation
2011-12-21 10:07:39 +01:00
watchdog.c
watchdog: move watchdog_*_all_cpus under CONFIG_SYSCTL
2011-10-31 17:30:53 -07:00
workqueue.c
workqueue: make alloc_workqueue() take printf fmt and args for name
2012-01-10 16:30:54 -08:00
workqueue_sched.h