RFE: extend executable name filter to user, task, exclude

[rgbriggs]

Currently, the filter on executable file name is limited to the exit filter. Was there a good reason to limit it to this filter and can it be extended for use by user, task and exclude filters?

... audit_field_valid(...) { ... switch(f->type) { ... case AUDIT_EXE: ... if (entry->rule.listnr != AUDIT_FILTER_EXIT) return -EINVAL;

[WOnder93]

Kernel patch submitted: https://www.redhat.com/archives/linux-audit/2018-April/msg00114.html

Userspace support: https://github.com/linux-audit/audit-userspace/pull/48

Test suite patch: https://github.com/linux-audit/audit-testsuite/pull/68

[rgbriggs]

I had a quick look at the userspace and testsuite patches and I don't have any concerns.

[pcmoore]

See the audit-userspace PR, we need a positive nod from Steve before I'm going to merge the kernel piece.

[rgbriggs]

Upstream since 4.19-rc1 29c1372 ("audit: allow other filter list types for AUDIT_EXE")