From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f173.google.com (mail-qt1-f173.google.com [209.85.160.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41E523128C6 for ; Wed, 4 Feb 2026 04:10:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770178238; cv=none; b=kOMxUJex3O4QhtyWF6UYM/+WLFr4nXLuRTKMVj+fJATyQAKNREKtOyy7YL4oJR44uNzjYjgAsnlMw01SbVlNnLbe/r954TLJXF4FuAG+EDnUvSFvW5FoeZHPlP9i6dQvme8zE75vVqGeVT1opXb12IUXvLLlK/68n599xnWmJ1Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770178238; c=relaxed/simple; bh=NGBYbg7UkfwWA9S5rny5UeTYoAabz+VUvilCJzQcNqw=; h=Date:Message-ID:From:To:Cc:Subject; b=bO2H5EsfZyv90ghtfyl3bMDcCD1k2kbLsR7VBysB52HWRardxhYmTVheoG4fEfLitAPM925xio/wqjV8W7CpIMHwF+PaLWUvSvNgKvXoHqqRY56DDMVdb1AMUg60xptBdlAXzvem8DrWdrX9r1GA7990Y1mOu46poSOwrc+xe9g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com; spf=pass smtp.mailfrom=paul-moore.com; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b=fjmthoG3; arc=none smtp.client-ip=209.85.160.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b="fjmthoG3" Received: by mail-qt1-f173.google.com with SMTP id d75a77b69052e-5032e15525aso67895021cf.3 for ; Tue, 03 Feb 2026 20:10:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore.com; s=google; t=1770178235; x=1770783035; darn=vger.kernel.org; h=subject:cc:to:from:message-id:date:from:to:cc:subject:date :message-id:reply-to; bh=l7y0HD6pGn4U56GU3JSwAc1F4bSA91jQpSfjKPdrAoA=; b=fjmthoG3QLRFiOBYYv40Pq1LPDVotfGYvroA2ijzhKZeD2VIP3wm8ucPM40smXExXz Y23g/DPX9O0yJiqOQcxtdRaD7OYAfJN3TVdT3JSozibZabggZwNn1I3ATgrI7yQhC5pa 7lxPtKfKz4a/bsRZs8oRP/DF0UKqr6tZLss1qFVLFpHoLBLZlZjpLK9uWo2d/e1X8L20 I9NX4JpIIIEvIDLxpZwg6Et0Z7gntSYRrYMerqazl8YI0UFrR71LQ+p7b6V1Val8CCLL KJ91Lz4n3gqHfT7rkjZxPt962/5CPTboqbRGgC5U9PhdTSuwi2ObsMr081Z53dfGk4T8 uTRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770178235; x=1770783035; h=subject:cc:to:from:message-id:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=l7y0HD6pGn4U56GU3JSwAc1F4bSA91jQpSfjKPdrAoA=; b=b+Qb6tG2UXTDs5rId/VJcsRlfblmKJCXMrMzpe7JBty6Ns6B+zT6wUJr9nbGHHIb/z eazgHOgQraKsVZ1SNCIthBrRDLYhsrQoD2NUQCDMgg41qSdRXWsUweACPreuBJjIolG5 5bbF34tusK9VNbT7WBl9m45Fsc8+lNvWulhLhHlOJnpb3zzRbWgOo+8RCkw7BzFnKMtB ZIbPioRtBR8/DfbwyhPc0lkPOvMIKQRxQCicc0bmEcsivY1zQ29N/24w2JIpzHr9D4/r P0h/weT22b1p9OfDWy4323edF3v7mWkfK8uj4f97bms7IASe/kV6Ufp89zyCZRfy7El5 6Yew== X-Forwarded-Encrypted: i=1; AJvYcCWK6Qo/1nkG5nhJJ8JxoOR6e7Ep5wLkJX/cjLWxgzTk17T0KkkYiPVxzaKzFVoPdbLQU/2OIG03eeGCtJ4=@vger.kernel.org X-Gm-Message-State: AOJu0YyFZpQIn/GRp6ZGNN9xW2F58SYVZNyLZ4W4WiV7GWiCra9hxxMC +2QlwCIjA/nbHVgfa+mjgdrOCUebjMqmYgf24fE8XUdvWpSXfBjtL2akB0q8z5iPAw== X-Gm-Gg: AZuq6aI+8XvNt5aVc+BbcBvIM2vMogHoQsj1tAURuA2RVIIysA5zU+8XEn6LyB05pU7 zMdXQjPQn4makjke4fh//Mh2Aw6EG/eGGxfwwRtyjEMcMV4JYVuga/MO1hDhENm0j4jw7aRx64N Q1n1jVkJKXIPj+mRhSuiIDmsBWoXmJ3rBcH0qxhXOLJAsPlxsoid24W9I+adeAJBKihUM9endou wvhX41PY/uxDYmLX63rU4Q8fBW175ULbgX1BabCxfj8e42Qm8BtdhwgGuNCCkpK8PnfVfISuZ5g K3TTmLhiU0PXmEWuWxtkgGIKg6O74qqXx41fdLxmOXKybJVzDIN7PP0bqZC2gfbL4g+s9RFeF85 IZi2pR4syMQOymIHOVyyMeMxbkTIPJJlCOEDbURCvoaXDiRL4EDibVYVhkIRMRR/WoNupsZzFCQ INCnPw8BASogFPTUKkvql8LK62f1e4L47tNwi8d3eQu2ouY+mHlCY9/LXo X-Received: by 2002:ac8:598f:0:b0:4f1:de1c:dfa8 with SMTP id d75a77b69052e-5061c0deafbmr23497271cf.19.1770178234725; Tue, 03 Feb 2026 20:10:34 -0800 (PST) Received: from localhost (pool-71-126-255-178.bstnma.fios.verizon.net. [71.126.255.178]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5061c1f9470sm9076441cf.24.2026.02.03.20.10.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Feb 2026 20:10:33 -0800 (PST) Date: Tue, 03 Feb 2026 23:10:33 -0500 Message-ID: <4d8d54dd3db528deba7eddf05201b1df@paul-moore.com> From: Paul Moore To: Linus Torvalds Cc: audit@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [GIT PULL] audit/audit-pr-20260203 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Linus, This is a bit early, but due to some personal scheduling I'd rather send this to you now, and you always mention you prefer to get pull requests early (perhaps not this early?) so here is hoping this is a win-win. Here are the highlights for the audit changes queued for the Linux v7.0 merge window: - Improve the NETFILTER_PKT audit records Add source and destination ports to the NETFILTER_PKT audit records while also consolidating a lot of the code into a new, singular audit_log_nf_skb() function. This new approach to structuring the NETFILTER_PKT record generation should elimiate some unnecessary overhead when audit is not built into the kernel. - Update the audit syscall classifier code Add the listxattrat(), getxattrat(), and fchmodat2() syscall to the audit code which classifies syscalls into categories of operations, e.g. "read" or "change attributes". - Move the syscall classifier declarations into audit_arch.h Shuffle around some header file declarations to resolve some sparse warnings. Paul -- The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8: Linux 6.19-rc1 (2025-12-14 16:05:07 +1200) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20260203 for you to fetch changes up to 76489955c6d4a065ca69dc88faf7a50a59b66f35: audit: move the compat_xxx_class[] extern declarations to audit_arch.h (2026-01-09 16:37:59 -0500) ---------------------------------------------------------------- audit/stable-7.0 PR 20260203 ---------------------------------------------------------------- Ben Dooks (1): audit: move the compat_xxx_class[] extern declarations to audit_arch.h Jeffrey Bencteux (2): audit: add fchmodat2() to change attributes class audit: add missing syscalls to read class Ricardo Robaina (2): audit: add audit_log_nf_skb helper function audit: include source and destination ports to NETFILTER_PKT include/asm-generic/audit_change_attr.h | 3 include/asm-generic/audit_read.h | 6 include/linux/audit.h | 14 +- include/linux/audit_arch.h | 7 + kernel/audit.c | 159 ++++++++++++++++++++++++ net/netfilter/nft_log.c | 58 -------- net/netfilter/xt_AUDIT.c | 58 -------- 7 files changed, 185 insertions(+), 120 deletions(-) -- paul-moore.com