Re: [PATCH] audit: add missing syscalls to read class
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.audit,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Dec 27, 2025 Jeffrey Bencteux <[email protected]> wrote: > > The "at" variant of getxattr() and listxattr() are missing from the > audit read class. Calling getxattrat() or listxattrat() on a file to > read its extended attributes will bypass audit rules such as: > > -w /tmp/test -p rwa -k test_rwa > > The current patch adds missing syscalls to the audit read class. > > Signed-off-by: Jeffrey Bencteux <[email protected]> > --- > include/asm-generic/audit_read.h | 6 ++++++ > 1 file changed, 6 insertions(+) Merged into audit/dev, thanks Jeffrey! -- paul-moore.com