netfilter: create audit records for x_tables replaces

The setsockopt() syscall to replace tables is already recorded
in the audit logs. This patch stores additional information
such as table name and netfilter protocol.

Cc: Patrick McHardy <kaber@trash.net>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Thomas Graf <tgraf@redhat.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

2 files changed, 17 insertions, 0 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index ae227dfcf9c6..32b5c62a5042 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -104,6 +104,7 @@
 #define AUDIT_CAPSET            1322    /* Record showing argument to sys_capset */
 #define AUDIT_MMAP              1323    /* Record showing descriptor and flags in mmap */
 #define AUDIT_NETFILTER_PKT     1324    /* Packets traversing netfilter chains */
+#define AUDIT_NETFILTER_CFG     1325    /* Netfilter chain modifications */
 
 #define AUDIT_AVC               1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR       1401    /* Internal SE Linux Errors */
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index ee5de3af510a..fbc2b72091e0 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -23,6 +23,7 @@
 #include <linux/mutex.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
+#include <linux/audit.h>
 #include <net/net_namespace.h>
 
 #include <linux/netfilter/x_tables.h>
@@ -834,6 +835,21 @@ xt_replace_table(struct xt_table *table,
          */
         local_bh_enable();
 
+#ifdef CONFIG_AUDIT
+        if (audit_enabled) {
+                struct audit_buffer *ab;
+
+                ab = audit_log_start(current->audit_context, GFP_KERNEL,
+                                     AUDIT_NETFILTER_CFG);
+                if (ab) {
+                        audit_log_format(ab, "table=%s family=%u entries=%u",
+                                         table->name, table->af,
+                                         private->number);
+                        audit_log_end(ab);
+                }
+        }
+#endif
+
         return private;
 }
 EXPORT_SYMBOL_GPL(xt_replace_table);