On Dec 27, 2025 Jeffrey Bencteux <[email protected]> wrote: > > The "at" variant of getxattr() and listxattr() are missing from the > audit read class. Calling getxattrat() or listxattrat() on a file to > read its extended attributes will bypass audit rules such as: > > -w /tmp/test -p rwa -k test_rwa > > The current patch adds missing syscalls to the audit read class. > > Signed-off-by: Jeffrey Bencteux <[email protected]> > --- > include/asm-generic/audit_read.h | 6 ++++++ > 1 file changed, 6 insertions(+)
Merged into audit/dev, thanks Jeffrey! -- paul-moore.com
