kernel_optimize_test/include
Miloslav Trmac 522ed7767e Audit: add TTY input auditing
Add TTY input auditing, used to audit system administrator's actions.  This is
required by various security standards such as DCID 6/3 and PCI to provide
non-repudiation of administrator's actions and to allow a review of past
actions if the administrator seems to overstep their duties or if the system
becomes misconfigured for unknown reasons.  These requirements do not make it
necessary to audit TTY output as well.

Compared to an user-space keylogger, this approach records TTY input using the
audit subsystem, correlated with other audit events, and it is completely
transparent to the user-space application (e.g.  the console ioctls still
work).

TTY input auditing works on a higher level than auditing all system calls
within the session, which would produce an overwhelming amount of mostly
useless audit events.

Add an "audit_tty" attribute, inherited across fork ().  Data read from TTYs
by process with the attribute is sent to the audit subsystem by the kernel.
The audit netlink interface is extended to allow modifying the audit_tty
attribute, and to allow sending explanatory audit events from user-space (for
example, a shell might send an event containing the final command, after the
interactive command-line editing and history expansion is performed, which
might be difficult to decipher from the TTY input alone).

Because the "audit_tty" attribute is inherited across fork (), it would be set
e.g.  for sshd restarted within an audited session.  To prevent this, the
audit_tty attribute is cleared when a process with no open TTY file
descriptors (e.g.  after daemon startup) opens a TTY.

See https://www.redhat.com/archives/linux-audit/2007-June/msg00000.html for a
more detailed rationale document for an older version of this patch.

[akpm@linux-foundation.org: build fix]
Signed-off-by: Miloslav Trmac <mitr@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Fulghum <paulkf@microgate.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 09:05:47 -07:00
..
acpi Pull osi-now into release branch 2007-06-02 01:02:09 -04:00
asm-alpha fix alpha ISA support 2007-07-16 09:05:37 -07:00
asm-arm page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-arm26 dma-mapping: prevent dma dependent code from linking on !HAS_DMA archs 2007-07-16 09:05:45 -07:00
asm-avr32 page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-blackfin Blackfin arch: Add peripheral io API to gpio header file 2007-07-12 17:06:45 +08:00
asm-cris etrax: enable arbitary speed setting on tty ports 2007-07-16 09:05:38 -07:00
asm-frv FRV: Connect up new syscalls 2007-07-16 09:05:37 -07:00
asm-generic Introduce O_CLOEXEC 2007-07-16 09:05:45 -07:00
asm-h8300 dma-mapping: prevent dma dependent code from linking on !HAS_DMA archs 2007-07-16 09:05:45 -07:00
asm-i386 fix jvc cdrom drive lockup 2007-07-16 09:05:40 -07:00
asm-ia64 page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-m32r dma-mapping: prevent dma dependent code from linking on !HAS_DMA archs 2007-07-16 09:05:45 -07:00
asm-m68k page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-m68knommu PCI: remove pci_dac_dma_... APIs 2007-07-11 16:02:11 -07:00
asm-mips page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-parisc Introduce O_CLOEXEC 2007-07-16 09:05:45 -07:00
asm-powerpc page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-ppc page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-s390 dma-mapping: prevent dma dependent code from linking on !HAS_DMA archs 2007-07-16 09:05:45 -07:00
asm-sh page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-sh64 page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-sparc page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-sparc64 page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-um Add generic exit-time stack-depth checking to CONFIG_DEBUG_STACK_USAGE 2007-07-16 09:05:38 -07:00
asm-v850 v850: enable arbitary speed tty ioctls 2007-07-16 09:05:39 -07:00
asm-x86_64 page table handling cleanup 2007-07-16 09:05:36 -07:00
asm-xtensa page table handling cleanup 2007-07-16 09:05:36 -07:00
crypto
keys
linux Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
math-emu
media
mtd
net Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2007-07-15 16:50:46 -07:00
pcmcia PCMCIA-NETDEV : add new ID of lan&modem multifunction card 2007-07-08 22:16:39 -04:00
rdma IB/cm: Include HCA ACK delay in local ACK timeout 2007-07-10 21:50:05 -07:00
rxrpc
scsi [SCSI] Remove unused method scsi_device_cancel 2007-07-14 16:01:16 -05:00
sound [ALSA] version 1.0.14 2007-05-31 11:03:27 +02:00
video
Kbuild