selinux: log anon inode class name
authorChristian Göttsche <cgzones@googlemail.com>
Tue, 8 Mar 2022 17:09:26 +0000 (18:09 +0100)
committerPaul Moore <paul@paul-moore.com>
Tue, 3 May 2022 20:09:03 +0000 (16:09 -0400)
commitc29722fad4aabbf6bb841b8f058f858ec911df56
tree35e4e508fbec1d159d5c299650fe47a31d310a74
parentded34574d4d351ab0ca095a45496b393cef611c2
selinux: log anon inode class name

Log the anonymous inode class name in the security hook
inode_init_security_anon.  This name is the key for name based type
transitions on the anon_inode security class on creation.  Example:

    type=AVC msg=audit(02/16/22 22:02:50.585:216) : avc:  granted \
        { create } for  pid=2136 comm=mariadbd anonclass=[io_uring] \
        scontext=system_u:system_r:mysqld_t:s0 \
        tcontext=system_u:system_r:mysqld_iouring_t:s0 tclass=anon_inode

Add a new LSM audit data type holding the inode and the class name.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
[PM: adjusted 'anonclass' to be a trusted string, cgzones approved]
Signed-off-by: Paul Moore <paul@paul-moore.com>
include/linux/lsm_audit.h
security/lsm_audit.c
security/selinux/hooks.c