From: Steve Grubb Date: Fri, 13 Oct 2017 03:24:01 +0000 (-0400) Subject: audit: Add new syscalls to the perm=w filter X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=6e66ec3cae02952fcfc285cb156c11dcc61f4453;p=linux.git audit: Add new syscalls to the perm=w filter The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2. Signed-off-by: Steve Grubb Reviewed-by: Richard Guy Briggs [PM: cleaned up some whitespace errors] Signed-off-by: Paul Moore --- diff --git a/include/asm-generic/audit_dir_write.h b/include/asm-generic/audit_dir_write.h index 7b61db4fe72b1..cf1ebc39d4fb6 100644 --- a/include/asm-generic/audit_dir_write.h +++ b/include/asm-generic/audit_dir_write.h @@ -30,3 +30,6 @@ __NR_renameat, __NR_linkat, __NR_symlinkat, #endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif diff --git a/include/asm-generic/audit_write.h b/include/asm-generic/audit_write.h index 274575d7129fc..f5c4906d24dff 100644 --- a/include/asm-generic/audit_write.h +++ b/include/asm-generic/audit_write.h @@ -19,3 +19,6 @@ __NR_ftruncate64, #ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */ #endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif