[RFC PATCH ghak88 V1] audit: tie ANOM_ABEND records to syscall

[Paul Moore]

On Thu, May 31, 2018 at 4:28 PM, Richard Guy Briggs <rgb at redhat.com> wrote:
> Since core dump events are triggered by user activity, tie the
> ANOM_ABEND record to the syscall record to collect all records from the
> same event.
>
> See: https://github.com/linux-audit/audit-kernel/issues/88
>
> Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> ---
>  kernel/auditsc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Another for after the merge window.

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index fefb9e2..5f0bd5e 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2461,7 +2461,7 @@ void audit_core_dumps(long signr)
>         if (signr == SIGQUIT)   /* don't care for those */
>                 return;
>
> -       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
> +       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND);
>         if (unlikely(!ab))
>                 return;
>         audit_log_task(ab);
> --
> 1.8.3.1

-- 
paul moore
www.paul-moore.com