[PATCH] promiscuous mode

Hi,

When a network interface goes into promiscuous mode, its an important security
issue. The attached patch is intended to capture that action and send an
event to the audit system.

The patch carves out a new block of numbers for kernel detected anomalies.
These are events that may indicate suspicious activity. Other examples of
potential kernel anomalies would be: exceeding disk quota, rlimit violations,
changes to syscall entry table.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 7 insertions, 0 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 2afb0de95329..e9f84a66ce81 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -115,6 +115,7 @@
 #include <net/iw_handler.h>
 #endif  /* CONFIG_NET_RADIO */
 #include <asm/current.h>
+#include <linux/audit.h>
 
 /*
  *      The list of packet types we will receive (as opposed to discard)
@@ -2120,6 +2121,12 @@ void dev_set_promiscuity(struct net_device *dev, int inc)
                 printk(KERN_INFO "device %s %s promiscuous mode\n",
                        dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
                                                                "left");
+                audit_log(current->audit_context, GFP_ATOMIC,
+                        AUDIT_ANOM_PROMISCUOUS,
+                        "dev=%s prom=%d old_prom=%d auid=%u",
+                        dev->name, (dev->flags & IFF_PROMISC),
+                        (old_flags & IFF_PROMISC),
+                        audit_get_loginuid(current->audit_context)); 
         }
 }