2 files changed, 13 insertions, 1 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index d760430c8de3..1c47c59058c1 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -35,7 +35,8 @@
  * 1400 - 1499 SE Linux use
  * 1500 - 1599 kernel LSPP events
  * 1600 - 1699 kernel crypto events
- * 1700 - 1999 future kernel use (maybe integrity labels and related events)
+ * 1700 - 1799 kernel anomaly records
+ * 1800 - 1999 future kernel use (maybe integrity labels and related events)
  * 2000 is for otherwise unclassified kernel audit messages (legacy)
  * 2001 - 2099 unused (kernel)
  * 2100 - 2199 user space anomaly records
@@ -90,6 +91,10 @@
 #define AUDIT_MAC_STATUS        1404    /* Changed enforcing,permissive,off */
 #define AUDIT_MAC_CONFIG_CHANGE 1405    /* Changes to booleans */
 
+#define AUDIT_FIRST_KERN_ANOM_MSG   1700
+#define AUDIT_LAST_KERN_ANOM_MSG    1799
+#define AUDIT_ANOM_PROMISCUOUS      1700 /* Device changed promiscuous mode */
+
 #define AUDIT_KERNEL            2000    /* Asynchronous audit record. NOT A REQUEST. */
 
 /* Rule flags */
diff --git a/net/core/dev.c b/net/core/dev.c
index 2afb0de95329..e9f84a66ce81 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -115,6 +115,7 @@
 #include <net/iw_handler.h>
 #endif  /* CONFIG_NET_RADIO */
 #include <asm/current.h>
+#include <linux/audit.h>
 
 /*
  *      The list of packet types we will receive (as opposed to discard)
@@ -2120,6 +2121,12 @@ void dev_set_promiscuity(struct net_device *dev, int inc)
                 printk(KERN_INFO "device %s %s promiscuous mode\n",
                        dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
                                                                "left");
+                audit_log(current->audit_context, GFP_ATOMIC,
+                        AUDIT_ANOM_PROMISCUOUS,
+                        "dev=%s prom=%d old_prom=%d auid=%u",
+                        dev->name, (dev->flags & IFF_PROMISC),
+                        (old_flags & IFF_PROMISC),
+                        audit_get_loginuid(current->audit_context)); 
         }
 }