|
From: Mikhail K. <vie...@vi...> - 2016-12-12 16:50:14
|
since we have "fowner=" option, is it possible add fowner into
integrity_audit_msg output too? I found this useful in my case.
I mean something like this:
--- a/security/integrity/integrity_audit.c.orig 2016-12-12 19:41:45.885938794 +0300
+++ b/security/integrity/integrity_audit.c 2016-12-03 17:29:47.104503180 +0300
@@ -56,6 +56,7 @@ void integrity_audit_msg(int audit_msgno
audit_log_untrustedstring(ab, fname);
}
if (inode) {
+ audit_log_format(ab, " fowner=%u", __kuid_val(inode->i_uid));
audit_log_format(ab, " dev=");
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
--
Best regards,
Mikhail Kurinnoi
|