[PATCH v2] audit: add missing syscalls to signal class

[PATCH v2] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
to be used only in kernel/auditfilter.c to increment the audit_signals
counter.

This counter is used to determine if information related to a target
process of a syscall audit rule using signals, such as its pid,
should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).

Information related to signals sent via these system calls are
currently not correctly logged. The current patch adds it to the
AUDIT_CLASS_SIGNAL* class.

Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
---
Changes in v2:
- Removal of unneeded #ifdef guards

 include/asm-generic/audit_signal.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/asm-generic/audit_signal.h b/include/asm-generic/audit_signal.h
index 6feab7f18a53..c02edbee3311 100644
--- a/include/asm-generic/audit_signal.h
+++ b/include/asm-generic/audit_signal.h
@@ -1,3 +1,6 @@
 __NR_kill,
 __NR_tgkill,
 __NR_tkill,
+__NR_rt_sigqueueinfo,
+__NR_rt_tgsigqueueinfo,
+__NR_pidfd_send_signal,

base-commit: 6614d4c05c7a661a925b3d8dbf9c70faac3bd2da
-- 
2.56.0