mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-09-18 22:14:16 +00:00
audit: record AUDIT_ANOM_* events regardless of presence of rules
When no audit rules are in place, AUDIT_ANOM_{LINK,CREAT} events reported in audit_log_path_denied() are unconditionally dropped due to an explicit check for the existence of any audit rules. Given this is a report of a security violation, allow it to be recorded regardless of the existence of any audit rules. To test, mkdir -p /root/tmp chmod 1777 /root/tmp touch /root/tmp/test.txt useradd test chown test /root/tmp/test.txt {echo C0644 12 test.txt; printf 'hello\ntest1\n'; printf \\000;} | \ scp -t /root/tmp Check with ausearch -m ANOM_CREAT -ts recent Link: https://issues.redhat.com/browse/RHEL-9065 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
parent
baaba7b448
commit
654d61b8e0
1 changed files with 1 additions and 1 deletions
|
@ -2285,7 +2285,7 @@ void audit_log_path_denied(int type, const char *operation)
|
|||
{
|
||||
struct audit_buffer *ab;
|
||||
|
||||
if (!audit_enabled || audit_dummy_context())
|
||||
if (!audit_enabled)
|
||||
return;
|
||||
|
||||
/* Generate log with subject, operation, outcome. */
|
||||
|
|
Loading…
Add table
Reference in a new issue