audit: allow audit matching on inode gid

Much like the ability to filter audit on the uid of an inode collected, we
should be able to filter on the gid of the inode.

Signed-off-by: Eric Paris <eparis@redhat.com>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 55cb3daaf474172192ab85ec55daf08a9e6004bc..e36aa37c88af8c9aa0ff42743d7a84ba7a4bf590 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -224,6 +224,7 @@
 #define AUDIT_DIR      107
 #define AUDIT_FILETYPE 108
 #define AUDIT_OBJ_UID  109
+#define AUDIT_OBJ_GID  110
 
 #define AUDIT_ARG0      200
 #define AUDIT_ARG1      (AUDIT_ARG0+1)

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 13e997423dcd85d43af5741098b51a8f70fce4cb..f10605c787e6817422ed7a0a045401b8b232d855 100644 (file)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -462,6 +462,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                case AUDIT_ARG2:
                case AUDIT_ARG3:
                case AUDIT_OBJ_UID:
+               case AUDIT_OBJ_GID:
                        break;
                case AUDIT_ARCH:
                        entry->rule.arch_f = f;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 5cf3ecc015176162481d13b257c3efc603c5a7a6..87b375fb12ffd6d71dadbc8598d53852f109f4c0 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -598,6 +598,18 @@ static int audit_filter_rules(struct task_struct *tsk,
                                }
                        }
                        break;
+               case AUDIT_OBJ_GID:
+                       if (name) {
+                               result = audit_comparator(name->gid, f->op, f->val);
+                       } else if (ctx) {
+                               list_for_each_entry(n, &ctx->names_list, list) {
+                                       if (audit_comparator(n->gid, f->op, f->val)) {
+                                               ++result;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
                case AUDIT_WATCH:
                        if (name)
                                result = audit_watch_compare(rule->watch, name->ino, name->dev);