audit: add fields to exclude filter by reusing user filter
authorRichard Guy Briggs <rgb@redhat.com>
Fri, 24 Jun 2016 20:35:46 +0000 (16:35 -0400)
committerPaul Moore <paul@paul-moore.com>
Mon, 27 Jun 2016 15:01:00 +0000 (11:01 -0400)
commit86b2efbe3a390e07dbba725ef700b0d143e9a385
tree6f29eca2803a82292ca3fd0f282b37764445d547
parentda7f750c1ef570c0a22e5a3fc1fdfd8d308d9a1a
audit: add fields to exclude filter by reusing user filter

RFE: add additional fields for use in audit filter exclude rules
https://github.com/linux-audit/audit-kernel/issues/5

Re-factor and combine audit_filter_type() with audit_filter_user() to
use audit_filter_user_rules() to enable the exclude filter to
additionally filter on PID, UID, GID, AUID, LOGINUID_SET, SUBJ_*.

The process of combining the similar audit_filter_user() and
audit_filter_type() functions, required inverting the meaning and
including the ALWAYS action of the latter.

Include audit_filter_user_rules() into audit_filter(), removing
unneeded logic in the process.

Keep the check to quit early if the list is empty.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: checkpatch.pl fixes - whitespace damage, wrapped description]
Signed-off-by: Paul Moore <paul@paul-moore.com>
include/linux/audit.h
kernel/audit.c
kernel/audit.h
kernel/auditfilter.c