audit: Make AUDIT_ANOM_ABEND event normalized
PATCH 1/1 audit: Make AUDIT_ANOM_ABEND event normalized
The audit event specification asks for certain fields to exist in all events. Running 'ausearch -m anom_abend -sv yes' returns no events. This patch adds the result field so that the AUDIT_ANOM_ABEND event conforms to the rules.
Signed-off-by Steve Grubb <[email protected]>
--- kernel/auditsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/auditsc.c +1 -1
@@ -2403,7 +2403,7 @@ void audit_core_dumps(long signr)if (unlikely (!ab))return ;audit_log_task (ab); -audit_log_format (ab," sig=%ld" , signr); +audit_log_format (ab," sig=%ld res=1" , signr);audit_log_end (ab); }
Signature · 1 line
2.7.4
Paul Moore
maintainerQuoted 9 lines · Steve Grubb
The audit event specification asks for certain fields to exist in all events. Running 'ausearch -m
anom_abend-sv yes' returns no events. This patch adds the result field so that theAUDIT_ANOM_ABENDevent conforms to the rules.Signed-off-by Steve Grubb <[email protected]>--- kernel/auditsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Looks good to me, added to the queue of patches to merge after the upcoming merge window.
Quoted 21 lines
kernel/auditsc.c +1
-2@@ -2403,7 +2403,7 @@ void audit_core_dumps(long signr)if (unlikely (!ab))return ;audit_log_task (ab); -audit_log_format (ab," sig=%ld" , signr); +audit_log_format (ab," sig=%ld res=1" , signr);audit_log_end (ab); } --2.7.4
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
Signature · 2 lines
paul moore www.paul-moore.com