From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 6 May 2006 12:26:27 +0000 (-0400)
Subject: [PATCH] add filtering by ppid
X-Git-Tag: v2.6.18-rc1~1102^2~13
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3c66251e573219a0532a5a07381b2f60a412d9eb;p=linux-2.6

[PATCH] add filtering by ppid

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 1057e90bd3..8f6424f2b6 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -152,6 +152,7 @@
 #define AUDIT_SE_TYPE	15	/* security label type */
 #define AUDIT_SE_SEN	16	/* security label sensitivity label */
 #define AUDIT_SE_CLR	17	/* security label clearance label */
+#define AUDIT_PPID	18
 
 				/* These are ONLY useful when checking
 				 * at syscall exit time (AUDIT_AT_EXIT). */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4fc3867fa2..e4551659ad 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_PID:
 			result = audit_comparator(tsk->pid, f->op, f->val);
 			break;
+		case AUDIT_PPID:
+			if (ctx)
+				result = audit_comparator(ctx->ppid, f->op, f->val);
+			break;
 		case AUDIT_UID:
 			result = audit_comparator(tsk->uid, f->op, f->val);
 			break;