Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

audit: record fanotify event regardless of presence of rules

When no audit rules are in place, fanotify event results are
unconditionally dropped due to an explicit check for the existence of
any audit rules. Given this is a report from another security
sub-system, allow it to be recorded regardless of the existence of any
audit rules.

To test, install and run the fapolicyd daemon with default config. Then
as an unprivileged user, create and run a very simple binary that should
be denied. Then check for an event with
ausearch -m FANOTIFY -ts recent

Link: https://issues.redhat.com/browse/RHEL-9065
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Richard Guy Briggs and committed by
Paul Moore
ce8370e2 df1145b5

+1 -1
+1 -1
include/linux/audit.h
··· 527 527 528 528 static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar) 529 529 { 530 - if (!audit_dummy_context()) 530 + if (audit_enabled) 531 531 __audit_fanotify(response, friar); 532 532 } 533 533