audit: Make AUDIT_KERNEL event conform to the specification
PATCH 1/1 audit: Make AUDIT_KERNEL event conform to the specification
The AUDIT_KERNEL event is not following name=value format. This causes some information to get lost. The event has been reformatted to follow the convention. Additionally the audit_enabled value was added for troubleshooting purposes. The following is an example of the new event:
type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1
--- kernel/audit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/audit.c +3 -1
@@ -1252,7 +1252,9 @@ static int __init audit_init(void) audit_enabled = audit_default; audit_ever_enabled |= !!audit_default; -audit_log (NULL ,GFP_KERNEL ,AUDIT_KERNEL ,"initialized" ); +audit_log (NULL ,GFP_KERNEL ,AUDIT_KERNEL , +"state=initialized audit_enabled=%u res=1" , + audit_enabled);for (i =0 ; i <AUDIT_INODE_BUCKETS ; i++)INIT_LIST_HEAD (&audit_inode_hash[i]);
Signature · 1 line
2.7.4
Paul Moore
maintainerQuoted 11 lines · Steve Grubb
The
AUDIT_KERNELevent is not following name=value format. This causes some information to get lost. The event has been reformatted to follow the convention. Additionally theaudit_enabledvalue was added for troubleshooting purposes. The following is an example of the new event:type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1
Signed-off-by sgrubb <[email protected]>--- kernel/audit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Looks reasonable. I fixed your name (sgrubb -> Steve Grubb) and merged this into my next queue for after the upcoming merge window.
Quoted 23 lines
kernel/audit.c +3
-2@@ -1252,7 +1252,9 @@ static int __init audit_init(void) audit_enabled = audit_default; audit_ever_enabled |= !!audit_default; -audit_log (NULL ,GFP_KERNEL ,AUDIT_KERNEL ,"initialized" ); +audit_log (NULL ,GFP_KERNEL ,AUDIT_KERNEL , +"state=initialized audit_enabled=%u res=1" , + audit_enabled);for (i =0 ; i <AUDIT_INODE_BUCKETS ; i++)INIT_LIST_HEAD (&audit_inode_hash[i]); --2.7.4
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
Signature · 2 lines
paul moore www.paul-moore.com