]> git.ipfire.org Git - thirdparty/linux.git/commit
audit: record AUDIT_ANOM_* events regardless of presence of rules
authorRichard Guy Briggs <rgb@redhat.com>
Wed, 5 Mar 2025 21:33:20 +0000 (16:33 -0500)
committerPaul Moore <paul@paul-moore.com>
Fri, 11 Apr 2025 18:14:41 +0000 (14:14 -0400)
commit654d61b8e0e2f8b9bdea28a9a51279ecdacafe3c
tree8f415b70753be9926825a4ed10e4b038d2ace81d
parentbaaba7b4483731592334611f4170160ae8a4d5f7
audit: record AUDIT_ANOM_* events regardless of presence of rules

When no audit rules are in place, AUDIT_ANOM_{LINK,CREAT} events
reported in audit_log_path_denied() are unconditionally dropped due to
an explicit check for the existence of any audit rules.  Given this is a
report of a security violation, allow it to be recorded regardless of
the existence of any audit rules.

To test,
mkdir -p /root/tmp
chmod 1777 /root/tmp
touch /root/tmp/test.txt
useradd test
chown test /root/tmp/test.txt
{echo C0644 12 test.txt; printf 'hello\ntest1\n'; printf \\000;} | \
scp -t /root/tmp
Check with
ausearch -m ANOM_CREAT -ts recent

Link: https://issues.redhat.com/browse/RHEL-9065
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit.c