diff options
| author | Richard Guy Briggs <[email protected]> | 2025-03-05 21:33:20 +0000 |
|---|---|---|
| committer | Paul Moore <[email protected]> | 2025-04-11 18:14:41 +0000 |
| commit | 654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c (patch) | |
| tree | 8f415b70753be9926825a4ed10e4b038d2ace81d /drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | |
| parent | audit: mark audit_log_vformat() with __printf() attribute (diff) | |
| download | kernel-654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c.tar.gz kernel-654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c.zip | |
audit: record AUDIT_ANOM_* events regardless of presence of rules
When no audit rules are in place, AUDIT_ANOM_{LINK,CREAT} events
reported in audit_log_path_denied() are unconditionally dropped due to
an explicit check for the existence of any audit rules. Given this is a
report of a security violation, allow it to be recorded regardless of
the existence of any audit rules.
To test,
mkdir -p /root/tmp
chmod 1777 /root/tmp
touch /root/tmp/test.txt
useradd test
chown test /root/tmp/test.txt
{echo C0644 12 test.txt; printf 'hello\ntest1\n'; printf \\000;} | \
scp -t /root/tmp
Check with
ausearch -m ANOM_CREAT -ts recent
Link: https://issues.redhat.com/browse/RHEL-9065
Signed-off-by: Richard Guy Briggs <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c')
0 files changed, 0 insertions, 0 deletions