diff options
| author | Ondrej Mosnacek | 2019-04-10 11:14:19 +0200 |
|---|---|---|
| committer | Paul Moore | 2019-04-16 00:10:17 +0200 |
| commit | 2d87a0674bd60d855e4008e2d84f5b23d7cb9b7d (patch) | |
| tree | f1652a306b9313539536d13ab52aa94249d1b0c9 /include/uapi/linux/audit.h | |
| parent | audit: purge unnecessary list_empty calls (diff) | |
| download | kernel-qcow2-linux-2d87a0674bd60d855e4008e2d84f5b23d7cb9b7d.tar.gz kernel-qcow2-linux-2d87a0674bd60d855e4008e2d84f5b23d7cb9b7d.tar.xz kernel-qcow2-linux-2d87a0674bd60d855e4008e2d84f5b23d7cb9b7d.zip | |
timekeeping: Audit clock adjustments
Emit an audit record whenever the system clock is changed (i.e. shifted
by a non-zero offset) by a syscall from userspace. The syscalls than can
(at the time of writing) trigger such record are:
- settimeofday(2), stime(2), clock_settime(2) -- via
do_settimeofday64()
- adjtimex(2), clock_adjtime(2) -- via do_adjtimex()
The new records have type AUDIT_TIME_INJOFFSET and contain the following
fields:
- sec -- the 'seconds' part of the offset
- nsec -- the 'nanoseconds' part of the offset
Example record (time was shifted backwards by ~15.875 seconds):
type=TIME_INJOFFSET msg=audit(1530616049.652:13): sec=-16 nsec=124887145
The records of this type will be associated with the corresponding
syscall records.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
[PM: fixed a line width problem in __audit_tk_injoffset()]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/uapi/linux/audit.h')
| -rw-r--r-- | include/uapi/linux/audit.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 3901c51c0b93..ab58d67baf4d 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -114,6 +114,7 @@ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ +#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |