[PATCH] Add End of Event record

[Steve Grubb]

Hi,

This patch adds an end of event record type. It will be sent by the kernel as
the last record when a multi-record event is triggered. This will aid realtime
analysis programs since they will now reliably know they have the last record
to complete an event. The audit daemon filters this and will not write it to
disk.

Signed-off-by: Steve Grubb <sgrubb at redhat.com>


diff -urp linux-2.6.22.x86_64.orig/include/linux/audit.h linux-2.6.22.x86_64/include/linux/audit.h
--- linux-2.6.22.x86_64.orig/include/linux/audit.h	2007-09-26 06:48:26.000000000 -0400
+++ linux-2.6.22.x86_64/include/linux/audit.h	2007-09-26 06:40:25.000000000 -0400
@@ -96,6 +96,7 @@
 #define AUDIT_FD_PAIR		1317    /* audit record for pipe/socketpair */
 #define AUDIT_OBJ_PID		1318	/* ptrace target */
 #define AUDIT_TTY		1319	/* Input on an administrative TTY */
+#define AUDIT_EOE		1320	/* End of multi-record event */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
diff -urp linux-2.6.22.x86_64.orig/kernel/auditsc.c linux-2.6.22.x86_64/kernel/auditsc.c
--- linux-2.6.22.x86_64.orig/kernel/auditsc.c	2007-09-26 06:48:40.000000000 -0400
+++ linux-2.6.22.x86_64/kernel/auditsc.c	2007-09-26 06:46:59.000000000 -0400
@@ -1117,6 +1117,11 @@ static void audit_log_exit(struct audit_
 
 		audit_log_end(ab);
 	}
+
+	/* Send end of event record to help user space know we are finished */
+	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+	if (ab)
+		audit_log_end(ab);
 	if (call_panic)
 		audit_panic("error converting sid to string");
 }