audit: comparison on interprocess fields

This allows audit to specify rules in which we compare two fields of a
process.  Such as is the running process uid != to the running process
euid?

Signed-off-by: Peter Moody <pmoody@google.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 23 insertions, 1 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 67113cb4bc15..9ff7a2c48b50 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -193,7 +193,29 @@
 #define AUDIT_COMPARE_FSUID_TO_OBJ_UID  8
 #define AUDIT_COMPARE_FSGID_TO_OBJ_GID  9
 
-#define AUDIT_MAX_FIELD_COMPARE         AUDIT_COMPARE_FSGID_TO_OBJ_GID
+#define AUDIT_COMPARE_UID_TO_AUID       10
+#define AUDIT_COMPARE_UID_TO_EUID       11
+#define AUDIT_COMPARE_UID_TO_FSUID      12
+#define AUDIT_COMPARE_UID_TO_SUID       13
+
+#define AUDIT_COMPARE_AUID_TO_FSUID     14
+#define AUDIT_COMPARE_AUID_TO_SUID      15
+#define AUDIT_COMPARE_AUID_TO_EUID      16
+
+#define AUDIT_COMPARE_EUID_TO_SUID      17
+#define AUDIT_COMPARE_EUID_TO_FSUID     18
+
+#define AUDIT_COMPARE_SUID_TO_FSUID     19
+
+#define AUDIT_COMPARE_GID_TO_EGID       20
+#define AUDIT_COMPARE_GID_TO_FSGID      21
+#define AUDIT_COMPARE_GID_TO_SGID       22
+
+#define AUDIT_COMPARE_EGID_TO_FSGID     23
+#define AUDIT_COMPARE_EGID_TO_SGID      24
+#define AUDIT_COMPARE_SGID_TO_FSGID     25
+
+#define AUDIT_MAX_FIELD_COMPARE         AUDIT_COMPARE_SGID_TO_FSGID
 
 /* Rule fields */
                                 /* These are useful when checking the