[PATCH] Make most file operations structs in fs/ const

[linux-2.6-omap-h63xx.git] / include / linux / audit.h

diff --git a/include/linux/audit.h b/include/linux/audit.h
index fbc21d6267f3db3d58b59f5c9d194cf1de2bea0a..1c47c59058c1ad2573d4c77a9f4dc5912750d687 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -35,7 +35,8 @@
  * 1400 - 1499 SE Linux use
  * 1500 - 1599 kernel LSPP events
  * 1600 - 1699 kernel crypto events
- * 1700 - 1999 future kernel use (maybe integrity labels and related events)
+ * 1700 - 1799 kernel anomaly records
+ * 1800 - 1999 future kernel use (maybe integrity labels and related events)
  * 2000 is for otherwise unclassified kernel audit messages (legacy)
  * 2001 - 2099 unused (kernel)
  * 2100 - 2199 user space anomaly records
@@ -50,15 +51,18 @@
  */
 #define AUDIT_GET              1000    /* Get status */
 #define AUDIT_SET              1001    /* Set status (enable/disable/auditd) */
-#define AUDIT_LIST             1002    /* List syscall filtering rules */
-#define AUDIT_ADD              1003    /* Add syscall filtering rule */
-#define AUDIT_DEL              1004    /* Delete syscall filtering rule */
+#define AUDIT_LIST             1002    /* List syscall rules -- deprecated */
+#define AUDIT_ADD              1003    /* Add syscall rule -- deprecated */
+#define AUDIT_DEL              1004    /* Delete syscall rule -- deprecated */
 #define AUDIT_USER             1005    /* Message from userspace -- deprecated */
 #define AUDIT_LOGIN            1006    /* Define the login id and information */
 #define AUDIT_WATCH_INS                1007    /* Insert file/dir watch entry */
 #define AUDIT_WATCH_REM                1008    /* Remove file/dir watch entry */
 #define AUDIT_WATCH_LIST       1009    /* List all file/dir watches */
 #define AUDIT_SIGNAL_INFO      1010    /* Get info about sender of signal to auditd */
+#define AUDIT_ADD_RULE         1011    /* Add syscall filtering rule */
+#define AUDIT_DEL_RULE         1012    /* Delete syscall filtering rule */
+#define AUDIT_LIST_RULES       1013    /* List syscall filtering rules */
 
 #define AUDIT_FIRST_USER_MSG   1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC         1107    /* We filter this differently */
@@ -83,6 +87,13 @@
 #define AUDIT_AVC              1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR      1401    /* Internal SE Linux Errors */
 #define AUDIT_AVC_PATH         1402    /* dentry, vfsmount pair from avc */
+#define AUDIT_MAC_POLICY_LOAD  1403    /* Policy file load */
+#define AUDIT_MAC_STATUS       1404    /* Changed enforcing,permissive,off */
+#define AUDIT_MAC_CONFIG_CHANGE        1405    /* Changes to booleans */
+
+#define AUDIT_FIRST_KERN_ANOM_MSG   1700
+#define AUDIT_LAST_KERN_ANOM_MSG    1799
+#define AUDIT_ANOM_PROMISCUOUS      1700 /* Device changed promiscuous mode */
 
 #define AUDIT_KERNEL           2000    /* Asynchronous audit record. NOT A REQUEST. */
 
@@ -226,6 +237,26 @@ struct audit_status {
        __u32           backlog;        /* messages waiting in queue */
 };
 
+/* audit_rule_data supports filter rules with both integer and string
+ * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and
+ * AUDIT_LIST_RULES requests.
+ */
+struct audit_rule_data {
+       __u32           flags;  /* AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND */
+       __u32           action; /* AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS */
+       __u32           field_count;
+       __u32           mask[AUDIT_BITMASK_SIZE]; /* syscall(s) affected */
+       __u32           fields[AUDIT_MAX_FIELDS];
+       __u32           values[AUDIT_MAX_FIELDS];
+       __u32           fieldflags[AUDIT_MAX_FIELDS];
+       __u32           buflen; /* total length of string fields */
+       char            buf[0]; /* string fields buffer */
+};
+
+/* audit_rule is supported to maintain backward compatibility with
+ * userspace.  It supports integer fields only and corresponds to
+ * AUDIT_ADD, AUDIT_DEL and AUDIT_LIST requests.
+ */
 struct audit_rule {            /* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */
        __u32           flags;  /* AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND */
        __u32           action; /* AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS */
@@ -335,7 +366,7 @@ extern void             audit_log_d_path(struct audit_buffer *ab,
 extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
 extern int audit_filter_type(int type);
 extern int  audit_receive_filter(int type, int pid, int uid, int seq,
-                                void *data, uid_t loginuid);
+                                void *data, size_t datasz, uid_t loginuid);
 #else
 #define audit_log(c,g,t,f,...) do { ; } while (0)
 #define audit_log_start(c,g,t) ({ NULL; })