Messages in this thread Patch in this message | | | From | Richard Guy Briggs <> | Subject | [PATCH ghak80 V1] audit: add syscall information to FEATURE_CHANGE records | Date | Wed, 11 Apr 2018 08:46:52 -0400 |
| |
Tie syscall information to FEATURE_CHANGE calls since it is a result of user action.
See: https://github.com/linux-audit/audit-kernel/issues/80
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- kernel/audit.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c index 8da24ef..23f125b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1103,10 +1103,9 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature { struct audit_buffer *ab; - if (audit_enabled == AUDIT_OFF) + if (!audit_enabled) return; - - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE); + ab = audit_log_start(current->audit_context, GFP_KERNEL, AUDIT_FEATURE_CHANGE); if (!ab) return; audit_log_task_info(ab, current); -- 1.8.3.1
| |