summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2012-10-10 23:25:22 +0400
committerAl Viro <viro@zeniv.linux.org.uk>2012-10-12 08:32:00 +0400
commit78e2e802a8519031e5858595070b39713e26340d (patch)
tree92f79d2039f4119a127ab59e31a2d1c9dfb892fe /include
parentc43a25abba97c7d87131e71db6be24b24d7791a5 (diff)
downloadlinux-78e2e802a8519031e5858595070b39713e26340d.tar.xz
audit: add a new "type" field to audit_names struct
For now, we just have two possibilities: UNKNOWN: for a new audit_names record that we don't know anything about yet NORMAL: for everything else In later patches, we'll add other types so we can distinguish and update records created under different circumstances. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'include')
-rw-r--r--include/linux/audit.h5
1 files changed, 5 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 8c66fc248c75..26408934ef2d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -452,6 +452,11 @@ struct audit_field {
extern int __init audit_register_class(int class, unsigned *list);
extern int audit_classify_syscall(int abi, unsigned syscall);
extern int audit_classify_arch(int arch);
+
+/* audit_names->type values */
+#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
+#define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
+
#ifdef CONFIG_AUDITSYSCALL
/* These are defined in auditsc.c */
/* Public API */