audit: implement all object interfield comparisons

This completes the matrix of interfield comparisons between uid/gid
information for the current task and the uid/gid information for inodes.
aka I can audit based on differences between the euid of the process and
the uid of fs objects.

Signed-off-by: Peter Moody <pmoody@google.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index fffbc2176ee1..67113cb4bc15 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -185,8 +185,16 @@
 /* AUDIT_FIELD_COMPARE rule list */
 #define AUDIT_COMPARE_UID_TO_OBJ_UID    1
 #define AUDIT_COMPARE_GID_TO_OBJ_GID    2
+#define AUDIT_COMPARE_EUID_TO_OBJ_UID   3
+#define AUDIT_COMPARE_EGID_TO_OBJ_GID   4
+#define AUDIT_COMPARE_AUID_TO_OBJ_UID   5
+#define AUDIT_COMPARE_SUID_TO_OBJ_UID   6
+#define AUDIT_COMPARE_SGID_TO_OBJ_GID   7
+#define AUDIT_COMPARE_FSUID_TO_OBJ_UID  8
+#define AUDIT_COMPARE_FSGID_TO_OBJ_GID  9
+
+#define AUDIT_MAX_FIELD_COMPARE         AUDIT_COMPARE_FSGID_TO_OBJ_GID
 
-#define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_GID_TO_OBJ_GID
 /* Rule fields */
                                 /* These are useful when checking the
                                  * task structure at task creation time