• Paul Moore's avatar
    lsm: Use a compressed IPv6 string format in audit events · d8116591
    Paul Moore authored
    Currently the audit subsystem prints uncompressed IPv6 addresses which not
    only differs from common usage but also results in ridiculously large audit
    strings which is not a good thing.  This patch fixes this by simply converting
    audit to always print compressed IPv6 addresses.
    
    Old message example:
    
     audit(1253576792.161:30): avc:  denied  { ingress } for
      saddr=0000:0000:0000:0000:0000:0000:0000:0001 src=5000
      daddr=0000:0000:0000:0000:0000:0000:0000:0001 dest=35502 netif=lo
      scontext=system_u:object_r:unlabeled_t:s15:c0.c1023
      tcontext=system_u:object_r:lo_netif_t:s0-s15:c0.c1023 tclass=netif
    
    New message example:
    
     audit(1253576792.161:30): avc:  denied  { ingress } for
      saddr=::1 src=5000 daddr=::1 dest=35502 netif=lo
      scontext=system_u:object_r:unlabeled_t:s15:c0.c1023
      tcontext=system_u:object_r:lo_netif_t:s0-s15:c0.c1023 tclass=netif
    Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    d8116591
lsm_audit.c 8.52 KB