From a24552c165346f087e82a52807d134e3910387a8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 1 Jun 2018 17:15:07 +0200 Subject: log: Add support for audit logging This is implemented via a pseudo log level. The kernel ignores any other parameter, so reject those at evaluation stage. Audit logging is therefore simply a matter of: | log level audit Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/evaluate.c') diff --git a/src/evaluate.c b/src/evaluate.c index 4eb36e2d..33733c0e 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2562,6 +2562,10 @@ static int stmt_evaluate_log(struct eval_ctx *ctx, struct stmt *stmt) return stmt_error(ctx, stmt, "flags and group are mutually exclusive"); } + if (stmt->log.level == LOGLEVEL_AUDIT && + (stmt->log.flags & ~STMT_LOG_LEVEL || stmt->log.logflags)) + return stmt_error(ctx, stmt, + "log level audit doesn't support any further options"); return 0; } -- cgit v1.2.3