RFE: add a session ID filter to the kernel's user filter

[pcmoore]

There are times when admins need to restrict audit events based on the session information. The session ID is in the netlink credentials coming from user space. They just didn't get added to the user filter when they were added to netlink. It would be nice to add them to the user filter.

[pcmoore]

While an RFE, this is a rather minor addition and a feature page isn't required, just the usual verbose patch description. However, as with all new changes a corresponding patch for the test suite will be required for kernel patch acceptance.

[pcmoore]

@rgbriggs Considering the discussions we've had regarding the SESSIONID_SET flag, I think it might be a good idea to provide a RFE page in the wiki for this patch(set). See the template page and the device auditing RFE page as an example; this should be quick work for this patchset.

• https://github.com/linux-audit/audit-kernel/wiki/Template-RFE
• https://github.com/linux-audit/audit-kernel/wiki/RFE-Device-Auditing

[rgbriggs]

RFE page ctreated:

• https://github.com/linux-audit/audit-kernel/wiki/RFE-Add-support-for-Session-ID-in-the-User-Filter

[pcmoore]

Thanks. I did rename the wiki page to something a bit more concise:

• https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter

I also don't see any mention of the SESSIONID_SET flag.