diff options
| author |   Richard Guy Briggs <rgb@redhat.com> | 2020-03-10 09:20:17 -0400 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2020-03-12 10:42:51 -0400 |
| commit | 1320a4052ea11eb2879eb7361da15a106a780972 (patch) | |
| tree | 335e3791ba5bc188ffad02e0328f22616ff2ef03 /kernel/audit.c | |
| parent | audit: CONFIG_CHANGE don't log internal bookkeeping as an event (diff) | |
| download | linux-dev-1320a4052ea11eb2879eb7361da15a106a780972.tar.xz linux-dev-1320a4052ea11eb2879eb7361da15a106a780972.zip | |
audit: trigger accompanying records when no rules present
When there are no audit rules registered, mandatory records (config,
etc.) are missing their accompanying records (syscall, proctitle, etc.).
This is due to audit context dummy set on syscall entry based on absence
of rules that signals that no other records are to be printed.
Clear the dummy bit if any record is generated.
The proctitle context and dummy checks are pointless since the
proctitle record will not be printed if no syscall records are printed.
Please see upstream github issue
https://github.com/linux-audit/audit-kernel/issues/120
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/audit.c')
| -rw-r--r-- | kernel/audit.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/audit.c b/kernel/audit.c index 17b0d523afb3..b96331e1976d 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1798,6 +1798,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, } audit_get_stamp(ab->ctx, &t, &serial); + audit_clear_dummy(ab->ctx); audit_log_format(ab, "audit(%llu.%03lu:%u): ", (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); |