audit subsystem

Most active threads (last 7 days)

No active threads in the last 7 days.

Recent patches

Latest 30 postings or standalone patches (up to 30), newest first. Counts below cover matching patches in linux-api touching this subsystem.

• UUID and GUID user and group ids (*_r system calls) v2 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH v2 30/41] ipc: add IPC_STAT_R and IPC_SET_R 2026-10-21
  2026-10-21 · Jan Koester <hidden>
• pidfd: add a minimal process spawn builder rfc · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH 16/24] audit: add pidfd spawn child contexts 2026-07-16
  2026-07-16 · Li Chen <hidden>
• Script execution control (was O_MAYEXEC) v23 · 1 matching patch

  Entire posting: LANDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v23 8/8] ima: instantiate the bprm_creds_for_exec() hook 2024-12-12
  2024-12-12 · Mickaël Salaün <mic@digikod.net>
• Script execution control (was O_MAYEXEC) v22 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v22 8/8] ima: instantiate the bprm_creds_for_exec() hook 2024-12-05
  2024-12-05 · Mickaël Salaün <mic@digikod.net>
• fanotify: Allow user space to pass back additional audit info v7 · 2 matching patches

  Entire posting: LANDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v7 1/3] fanotify: Ensure consistent variable type for response 2023-02-03
  • [PATCH v7 3/3] fanotify,audit: Allow audit to use the full permission event response 2023-02-03
  2023-02-03 · Richard Guy Briggs <hidden>
• fanotify: Allow user space to pass back additional audit info v6 · 2 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v6 1/3] fanotify: Ensure consistent variable type for response 2023-01-17
  • [PATCH v6 3/3] fanotify,audit: Allow audit to use the full permission event response 2023-01-17
  2023-01-17 · Richard Guy Briggs <hidden>
• fanotify: Allow user space to pass back additional audit info v5 · 2 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v5 1/3] fanotify: Ensure consistent variable type for response 2022-12-12
  • [PATCH v5 3/3] fanotify,audit: Allow audit to use the full permission event response 2022-12-12
  2022-12-12 · Richard Guy Briggs <hidden>
• [PATCH V1] audit: log xattr args not covered by syscall record 2021-05-07 · Richard Guy Briggs <hidden>
• audit: implement container identifier v11 · 8 matching patches

  Entire posting: PENDING · 7 of 11 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 v11 01/11] audit: collect audit task parameters 2021-01-12
  • [PATCH ghak90 v11 02/11] audit: add container id 2021-01-12
  • [PATCH ghak90 v11 03/11] audit: log container info of syscalls 2021-01-12
  • [PATCH ghak90 v11 04/11] audit: add contid support for signalling the audit daemon 2021-01-12
  • [PATCH ghak90 v11 05/11] audit: add support for non-syscall auxiliary records 2021-01-12
  • [PATCH ghak90 v11 07/11] audit: add containerid filtering 2021-01-12
  • [PATCH ghak90 v11 08/11] audit: add support for containerid to network namespaces 2021-01-12
  • [PATCH ghak90 v11 11/11] audit: add capcontid to set contid outside init_user_ns 2021-01-12
  2021-01-12 · Richard Guy Briggs <hidden>
• audit: implement container identifier v10 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 v10 01/11] audit: collect audit task parameters 2020-12-21
  • [PATCH ghak90 v10 02/11] audit: add container id 2020-12-21
  • [PATCH ghak90 v10 03/11] audit: log container info of syscalls 2020-12-21
  • [PATCH ghak90 v10 04/11] audit: add contid support for signalling the audit daemon 2020-12-21
  • [PATCH ghak90 v10 05/11] audit: add support for non-syscall auxiliary records 2020-12-21
  • [PATCH ghak90 v10 07/11] audit: add containerid filtering 2020-12-21
  • [PATCH ghak90 v10 08/11] audit: add support for containerid to network namespaces 2020-12-21
  • [PATCH ghak90 v10 11/11] audit: add capcontid to set contid outside init_user_ns 2020-12-21
  2020-12-21 · Richard Guy Briggs <hidden>
• fs: idmapped mounts v2 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 31/39] audit: handle idmapped mounts 2020-11-15
  2020-11-15 · Christian Brauner <hidden>
• fs: idmapped mounts v1 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 28/34] audit: handle idmapped mounts 2020-10-29
  2020-10-29 · Christian Brauner <hidden>
• audit: implement container identifier v9 · 9 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 V9 01/13] audit: collect audit task parameters 2020-06-27
  • [PATCH ghak90 V9 02/13] audit: add container id 2020-06-27
  • [PATCH ghak90 V9 05/13] audit: log container info of syscalls 2020-06-27
  • [PATCH ghak90 V9 06/13] audit: add contid support for signalling the audit daemon 2020-06-27
  • [PATCH ghak90 V9 07/13] audit: add support for non-syscall auxiliary records 2020-06-27
  • [PATCH ghak90 V9 09/13] audit: add containerid filtering 2020-06-27
  • [PATCH ghak90 V9 10/13] audit: add support for containerid to network namespaces 2020-06-27
  • [PATCH ghak90 V9 12/13] audit: track container nesting 2020-06-27
  • [PATCH ghak90 V9 13/13] audit: add capcontid to set contid outside init_user_ns 2020-06-27
  2020-06-27 · Richard Guy Briggs <hidden>
• audit: implement container identifier v8 · 12 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 V8 01/16] audit: collect audit task parameters 2019-12-31
  • [PATCH ghak90 V8 02/16] audit: add container id 2019-12-31
  • [PATCH ghak90 V8 04/16] audit: convert to contid list to check for orch/engine ownership 2019-12-31
  • [PATCH ghak90 V8 06/16] audit: log container info of syscalls 2019-12-31
  • [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon 2019-12-31
  • [PATCH ghak90 V8 08/16] audit: add support for non-syscall auxiliary records 2019-12-31
  • [PATCH ghak90 V8 10/16] audit: add containerid filtering 2019-12-31
  • [PATCH ghak90 V8 11/16] audit: add support for containerid to network namespaces 2019-12-31
  • [PATCH ghak90 V8 13/16] audit: track container nesting 2019-12-31
  • [PATCH ghak90 V8 14/16] audit: check contid depth and add limit config param 2019-12-31
  • [PATCH ghak90 V8 15/16] audit: check contid count per netns and add config param limit 2019-12-31
  • [PATCH ghak90 V8 16/16] audit: add capcontid to set contid outside init_user_ns 2019-12-31
  2019-12-31 · Richard Guy Briggs <hidden>
• audit: implement container identifier v7 · 13 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 V7 01/21] audit: collect audit task parameters 2019-09-19
  • [PATCH ghak90 V7 02/21] audit: add container id 2019-09-19
  • [PATCH ghak90 V7 04/21] audit: convert to contid list to check for orch/engine ownership 2019-09-19
  • [PATCH ghak90 V7 07/21] audit: log container info of syscalls 2019-09-19
  • [PATCH ghak90 V7 08/21] audit: add contid support for signalling the audit daemon 2019-09-19
  • [PATCH ghak90 V7 09/21] audit: add support for non-syscall auxiliary records 2019-09-19
  • [PATCH ghak90 V7 11/21] audit: add containerid filtering 2019-09-19
  • [PATCH ghak90 V7 12/21] audit: add support for containerid to network namespaces 2019-09-19
  • [PATCH ghak90 V7 13/21] audit: NETFILTER_PKT: record each container ID associated with a netNS 2019-09-19
  • [PATCH ghak90 V7 16/21] audit: add support for contid set/get by netlink 2019-09-19
  • [PATCH ghak90 V7 17/21] audit: add support for loginuid/sessionid set/get by netlink 2019-09-19
  • [PATCH ghak90 V7 18/21] audit: track container nesting 2019-09-19
  • [PATCH ghak90 V7 20/21] audit: add capcontid to set contid outside init_user_ns 2019-09-19
  2019-09-19 · Richard Guy Briggs <hidden>
• audit: implement container identifier v6 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 V6 01/10] audit: collect audit task parameters 2019-04-09
  • [PATCH ghak90 V6 02/10] audit: add container id 2019-04-09
  • [PATCH ghak90 V6 04/10] audit: log container info of syscalls 2019-04-09
  • [PATCH ghak90 V6 05/10] audit: add contid support for signalling the audit daemon 2019-04-09
  • [PATCH ghak90 V6 06/10] audit: add support for non-syscall auxiliary records 2019-04-09
  • [PATCH ghak90 V6 08/10] audit: add containerid filtering 2019-04-09
  • [PATCH ghak90 V6 09/10] audit: add support for containerid to network namespaces 2019-04-09
  • [PATCH ghak90 V6 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS 2019-04-09
  2019-04-09 · Richard Guy Briggs <hidden>
• audit: implement container identifier v5 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 V5 01/10] audit: collect audit task parameters 2019-03-15
  • [PATCH ghak90 V5 02/10] audit: add container id 2019-03-15
  • [PATCH ghak90 V5 04/10] audit: log container info of syscalls 2019-03-15
  • [PATCH ghak90 V5 05/10] audit: add containerid support for ptrace and signals 2019-03-15
  • [PATCH ghak90 V5 06/10] audit: add support for non-syscall auxiliary records 2019-03-15
  • [PATCH ghak90 V5 08/10] audit: add containerid filtering 2019-03-15
  • [PATCH ghak90 V5 09/10] audit: add support for containerid to network namespaces 2019-03-15
  • [PATCH ghak90 V5 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS 2019-03-15
  2019-03-15 · Richard Guy Briggs <hidden>
• [PATCH] arm64: introduce AUDIT_ARCH_AARCH64ILP32 for ilp32 2019-01-08 · Yuri Norov <hidden>
• audit: implement container identifier v4 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH ghak90 (was ghak32) V4 01/10] audit: collect audit task parameters 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 02/10] audit: add container id 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 03/10] audit: log container info of syscalls 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 04/10] audit: add containerid support for ptrace and signals 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 05/10] audit: add support for non-syscall auxiliary records 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 07/10] audit: add containerid filtering 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 08/10] audit: add support for containerid to network namespaces 2018-07-31
  • [PATCH ghak90 (was ghak32) V4 09/10] audit: NETFILTER_PKT: record each container ID associated with a netNS 2018-07-31
  2018-07-31 · Richard Guy Briggs <hidden>
• audit: implement container identifier v3 · 7 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH ghak90 (was ghak32) V3 01/10] audit: add container id 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 03/10] audit: add containerid support for ptrace and signals 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 04/10] audit: add support for non-syscall auxiliary records 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 06/10] audit: add containerid filtering 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 07/10] audit: add support for containerid to network namespaces 2018-06-06
  • [RFC PATCH ghak90 (was ghak32) V3 08/10] audit: NETFILTER_PKT: record each container ID associated with a netNS 2018-06-06
  2018-06-06 · Richard Guy Briggs <hidden>
• audit: implement container id v2 · 6 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH ghak32 V2 01/13] audit: add container id 2018-03-16
  • [RFC PATCH ghak32 V2 03/13] audit: log container info of syscalls 2018-03-16
  • [RFC PATCH ghak32 V2 04/13] audit: add containerid filtering 2018-03-16
  • [RFC PATCH ghak32 V2 05/13] audit: add containerid support for ptrace and signals 2018-03-16
  • [RFC PATCH ghak32 V2 06/13] audit: add support for non-syscall auxiliary records 2018-03-16
  • [RFC PATCH ghak32 V2 11/13] audit: add support for containerid to network namespaces 2018-03-16
  2018-03-16 · Richard Guy Briggs <hidden>
• audit: implement container id v1 · 6 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH V1 01/12] audit: add container id 2018-03-01
  • [RFC PATCH V1 02/12] audit: log container info of syscalls 2018-03-01
  • [RFC PATCH V1 03/12] audit: add containerid filtering 2018-03-01
  • [RFC PATCH V1 05/12] audit: add containerid support for ptrace and signals 2018-03-01
  • [RFC PATCH V1 06/12] audit: add support for non-syscall auxiliary records 2018-03-01
  • [RFC PATCH V1 11/12] debug audit: add container id 2018-03-01
  2018-03-01 · Richard Guy Briggs <hidden>
• REVIEWED · 1 review, 1 by a maintainer [PATCH v7 1/1] audit: Record fanotify access control decisions 2017-10-03 · Steve Grubb <hidden>
• REVIEWED · 1 review, 0 by maintainers [PATCH v6 1/1] audit: Record fanotify access control decisions 2017-09-26 · Steve Grubb <hidden>
• [PATCH v5 1/1] audit: Record fanotify access control decisions 2017-09-26 · Steve Grubb <hidden>
• [PATCH v4 1/1] audit: Record fanotify access control decisions 2017-09-26 · Steve Grubb <hidden>
• [PATCH v3 1/1] audit: Record fanotify access control decisions 2017-09-25 · Steve Grubb <hidden>
• Improved seccomp logging v6 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v6 3/6] seccomp: Sysctl to configure actions that are allowed to be logged 2017-08-11
  2017-08-11 · Tyler Hicks <hidden>
• Improved seccomp logging v5 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v5 2/6] seccomp: Sysctl to configure actions that are allowed to be logged 2017-07-28
  2017-07-28 · Tyler Hicks <hidden>
• Improved seccomp logging v4 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged 2017-02-14
  2017-02-14 · Tyler Hicks <hidden>