diff options
| author | Thomas Graf <tgraf@infradead.org> | 2011-01-16 18:12:59 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-01-16 18:12:59 +0100 |
| commit | fbabf31e4d482149b5e2704eb0287cf9117bdcf3 (patch) | |
| tree | b12a1123474ab9aa566fc1a6e57e050653588ba0 /net/netfilter/x_tables.c | |
| parent | 43f393caec0362abe03c72799d3f342af3973070 (diff) | |
| download | linux-fbabf31e4d482149b5e2704eb0287cf9117bdcf3.tar.gz | |
netfilter: create audit records for x_tables replaces
The setsockopt() syscall to replace tables is already recorded
in the audit logs. This patch stores additional information
such as table name and netfilter protocol.
Cc: Patrick McHardy <kaber@trash.net>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Thomas Graf <tgraf@redhat.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter/x_tables.c')
| -rw-r--r-- | net/netfilter/x_tables.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index ee5de3af510a7a..fbc2b72091e0a4 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -23,6 +23,7 @@ #include <linux/mutex.h> #include <linux/mm.h> #include <linux/slab.h> +#include <linux/audit.h> #include <net/net_namespace.h> #include <linux/netfilter/x_tables.h> @@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table, */ local_bh_enable(); +#ifdef CONFIG_AUDIT + if (audit_enabled) { + struct audit_buffer *ab; + + ab = audit_log_start(current->audit_context, GFP_KERNEL, + AUDIT_NETFILTER_CFG); + if (ab) { + audit_log_format(ab, "table=%s family=%u entries=%u", + table->name, table->af, + private->number); + audit_log_end(ab); + } + } +#endif + return private; } EXPORT_SYMBOL_GPL(xt_replace_table); |