system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-26 14:28:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/char
History
Miloslav Trmac 522ed7767e Audit: add TTY input auditing 
Add TTY input auditing, used to audit system administrator's actions.  This is
required by various security standards such as DCID 6/3 and PCI to provide
non-repudiation of administrator's actions and to allow a review of past
actions if the administrator seems to overstep their duties or if the system
becomes misconfigured for unknown reasons.  These requirements do not make it
necessary to audit TTY output as well.

Compared to an user-space keylogger, this approach records TTY input using the
audit subsystem, correlated with other audit events, and it is completely
transparent to the user-space application (e.g.  the console ioctls still
work).

TTY input auditing works on a higher level than auditing all system calls
within the session, which would produce an overwhelming amount of mostly
useless audit events.

Add an "audit_tty" attribute, inherited across fork ().  Data read from TTYs
by process with the attribute is sent to the audit subsystem by the kernel.
The audit netlink interface is extended to allow modifying the audit_tty
attribute, and to allow sending explanatory audit events from user-space (for
example, a shell might send an event containing the final command, after the
interactive command-line editing and history expansion is performed, which
might be difficult to decipher from the TTY input alone).

Because the "audit_tty" attribute is inherited across fork (), it would be set
e.g.  for sshd restarted within an audited session.  To prevent this, the
audit_tty attribute is cleared when a process with no open TTY file
descriptors (e.g.  after daemon startup) opens a TTY.

See https://www.redhat.com/archives/linux-audit/2007-June/msg00000.html for a
more detailed rationale document for an older version of this patch.

[akpm@linux-foundation.org: build fix]
Signed-off-by: Miloslav Trmac <mitr@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Fulghum <paulkf@microgate.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 09:05:47 -07:00
..
agp Merge master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart 2007-07-12 13:41:54 -07:00
drm Add support SiS based XGI chips to SiS DRM. 2007-06-27 09:54:49 -07:00
hw_random intel-rng: undo mess made by an 80 column extremist 2007-07-16 09:05:46 -07:00
ip2 Char: ip2, use msleep for sleeping 2007-07-16 09:05:44 -07:00
ipmi Use menuconfig objects II - IPMI 2007-07-16 09:05:40 -07:00
mwave [PATCH] mwave: interesting flags savings 2007-02-20 17:10:14 -08:00
pcmcia Merge git://git.kernel.org/pub/scm/linux/kernel/git/bunk/trivial 2007-05-09 12:54:17 -07:00
rio Overrun in drivers/char/rio/riocmd.c 2007-05-11 08:29:34 -07:00
tpm Use menuconfig objects II - TPM 2007-07-16 09:05:40 -07:00
watchdog Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog 2007-06-03 12:36:56 -07:00
.gitignore [MIPS] Remove IT8172-based platforms, ITE 8172G and Globespan IVR support. 2006-10-03 17:59:17 +01:00
amiserial.c drivers/char: use __set_current_state() 2007-05-08 11:15:13 -07:00
apm-emulation.c [APM] Add shared version of APM emulation 2007-02-09 17:08:57 +00:00
applicom.c IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
applicom.h
briq_panel.c [POWERPC] Rename get_property to of_get_property: drivers 2007-05-02 20:04:32 +10:00
cd1865.h
ChangeLog
consolemap.c Kernel utf-8 handling 2007-07-16 09:05:46 -07:00
cp437.uni
cs5535_gpio.c Char: cs5535_gpio, add MODULE_DEVICE_TABLE 2007-05-08 11:15:04 -07:00
cyclades.c Char: cyclades, fix deadlock 2007-05-23 20:14:13 -07:00
decserial.c [PATCH] dz: Fixes to make it work 2006-12-07 08:39:41 -08:00
defkeymap.c_shipped
defkeymap.map
digi1.h
digiFep1.h
digiPCI.h
ds1286.c [CHAR] ds1286: Fix handling of seconds in RTC_ALM_SET ioctl. 2007-03-08 01:10:30 +00:00
ds1302.c [PATCH] DS1302: local_irq_disable() is redundant after local_irq_save() 2007-02-12 09:48:30 -08:00
ds1620.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
dsp56k.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
dtlk.c dtlk: fix error checks in module_init() 2007-05-08 11:15:09 -07:00
ec3104_keyb.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
efirtc.c
epca.c drivers/char: use __set_current_state() 2007-05-08 11:15:13 -07:00
epca.h [PATCH] char: kill unneeded memsets 2006-10-04 07:55:13 -07:00
epcaconfig.h
esp.c [PATCH] tty: switch to ktermios 2006-12-08 08:28:57 -08:00
generic_nvram.c [PATCH] mark struct file_operations const 3 2007-02-12 09:48:45 -08:00
generic_serial.c [PATCH] generic_serial: fix decoding of baud rate 2007-03-27 09:05:15 -07:00
genrtc.c Char: genrtc, use wait_event_interruptible 2007-07-16 09:05:44 -07:00
hangcheck-timer.c Detach sched.h from mm.h 2007-05-21 09:18:19 -07:00
hpet.c [PATCH] sysctl: remove insert_at_head from register_sysctl 2007-02-14 08:09:59 -08:00
hvc_beat.c [POWERPC] Celleb: hypervisor console driver 2007-02-07 14:03:21 +11:00
hvc_console.c drivers/char/hvc_console.c: cleanups 2007-05-08 11:14:59 -07:00
hvc_console.h
hvc_iseries.c [POWERPC] Rename device_is_compatible to of_device_is_compatible 2007-05-07 20:31:14 +10:00
hvc_rtas.c
hvc_vio.c [POWERPC] Rename device_is_compatible to of_device_is_compatible 2007-05-07 20:31:14 +10:00
hvcs.c [PATCH] tty: switch to ktermios 2006-12-08 08:28:57 -08:00
hvsi.c [POWERPC] Rename get_property to of_get_property: partial drivers 2007-04-27 15:51:56 +10:00
i8k.c i386: sched.h inclusion from module.h is baack 2007-05-08 11:15:08 -07:00
ip27-rtc.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
isicom.c Char: isicom, use pr_debug 2007-05-08 11:15:24 -07:00
istallion.c [PATCH] Char: tty_wakeup cleanup 2007-02-11 10:51:26 -08:00
Kconfig undeprecate raw driver 2007-07-16 09:05:46 -07:00
keyboard.c Kernel utf-8 handling 2007-07-16 09:05:46 -07:00
lcd.c [CHAR] lcd: Fix two warnings. 2007-03-17 01:03:26 +00:00
lcd.h [MIPS] Add MTD device support for Cobalt 2007-02-20 17:11:55 +00:00
lp.c ROUND_UP macro cleanup in drivers/char/lp.c 2007-05-08 11:15:08 -07:00
Makefile Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
mbcs.c [PATCH] mark struct file_operations const 3 2007-02-12 09:48:45 -08:00
mbcs.h
mem.c Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus 2007-07-10 14:48:43 -07:00
misc.c Make /proc/misc use seq_list_xxx helpers 2007-07-16 09:05:42 -07:00
mmtimer.c [IA64-SN2][KJ] mmtimer.c-kzalloc 2007-05-08 11:53:27 -07:00
moxa.c old buffer overflow in moxa driver 2007-05-08 11:15:14 -07:00
mspec.c mspec_mmap: don't set VM_LOCKED 2007-07-16 09:05:36 -07:00
mxser.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
mxser.h [PATCH] mxser: remove ambiguous redefinition of INIT_WORK 2007-02-11 10:51:25 -08:00
mxser_new.c Char: mxser_new, fix sparse warning 2007-07-16 09:05:43 -07:00
mxser_new.h [PATCH] Char: mxser_new, upgrade to 1.9.15 2007-02-11 10:51:29 -08:00
n_hdlc.c Char: n_hdlc, allow RESTARTSYS retval of tty write 2007-07-16 09:05:43 -07:00
n_r3964.c Char: n_r3964, use wait_event_interruptible 2007-07-16 09:05:44 -07:00
n_tty.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
nsc_gpio.c [PATCH] struct path: convert char-drivers 2006-12-08 08:28:44 -08:00
nvram.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
nwbutton.c [PATCH] Char: timers cleanup 2007-02-12 09:48:30 -08:00
nwbutton.h IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
nwflash.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
pc8736x_gpio.c [PATCH] drivers/char/pc8736x_gpio.c: remove unused static functions 2006-09-29 09:18:05 -07:00
ppdev.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
pty.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
random.c random: fix output buffer folding 2007-06-16 13:16:16 -07:00
raw.c [PATCH] raw: don't allow the creation of a raw device with minor number 0 2007-02-11 10:51:34 -08:00
riscom8.c drivers/char: use __set_current_state() 2007-05-08 11:15:13 -07:00
riscom8.h
riscom8_reg.h
rocket.c rocket.c: fix unchecked mutex_lock_interruptible() 2007-07-16 09:05:43 -07:00
rocket.h
rocket_int.h Kill unused sesssion and group values in rocket driver 2007-05-11 08:29:36 -07:00
rtc.c RTC: Ratelimit "lost interrupts" message 2007-07-16 09:05:43 -07:00
scc.h
scx200_gpio.c [PATCH] scx200_gpio export cleanups 2006-09-29 09:18:06 -07:00
selection.c Kernel utf-8 handling 2007-07-16 09:05:46 -07:00
ser_a2232.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
ser_a2232.h
ser_a2232fw.ax
ser_a2232fw.h
serial167.c drivers/char: use __set_current_state() 2007-05-08 11:15:13 -07:00
snsc.c IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
snsc.h
snsc_event.c [IA64] drivers/char/snsc_event.c:206: warning: unused variable `p' 2007-05-10 13:23:05 -07:00
sonypi.c remove sonypi_camera_command() 2007-07-16 09:05:46 -07:00
specialix.c [PATCH] Char: timers cleanup 2007-02-12 09:48:30 -08:00
specialix_io8.h
stallion.c Char: stallion, fix oops during init with ISA cards 2007-06-24 08:59:11 -07:00
sx.c sx: switch subven and subid values 2007-07-10 17:51:13 -07:00
sx.h [PATCH] Char: sx, request regions 2006-12-08 08:28:59 -08:00
sxboards.h
sxwindow.h
synclink.c drivers/char/synclink.c: check kmalloc() return value 2007-05-08 11:15:02 -07:00
synclink_gt.c synclink_gt: add compat_ioctl 2007-05-11 08:29:34 -07:00
synclinkmp.c [PATCH] Char: timers cleanup 2007-02-12 09:48:30 -08:00
sysrq.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
tb0219.c [PATCH] struct path: convert char-drivers 2006-12-08 08:28:44 -08:00
tipar.c layered parport code uses parport->dev 2007-05-08 11:15:05 -07:00
tlclk.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
toshiba.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
tty_audit.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
tty_io.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
tty_ioctl.c Char: tty_ioctl, little whitespace cleanup 2007-07-16 09:05:44 -07:00
vc_screen.c use mutex instead of semaphore in virtual console driver 2007-05-08 11:15:33 -07:00
viocons.c [POWERPC] iSeries: fix viocons init 2006-12-20 16:37:48 +11:00
viotape.c [PATCH] mark struct file_operations const 3 2007-02-12 09:48:45 -08:00
vme_scc.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
vr41xx_giu.c [MIPS] Separate platform_device registration for VR41xx GPIO 2007-07-12 17:41:15 +01:00
vt.c console UTF-8 fixes (fix) 2007-06-24 08:59:10 -07:00
vt_ioctl.c drivers/char: use __set_current_state() 2007-05-08 11:15:13 -07:00