On Thu, 2007-09-27 at 09:16 -0400, Steve Grubb wrote:
> Hi,
>
> This patch adds an end of event record type. It will be sent by the kernel as
> the last record when a multi-record event is triggered. This will aid realtime
> analysis programs since they will now reliably know they have the last record
> to complete an event. The audit daemon filters this and will not write it to
> disk.
>
> Signed-off-by: Steve Grubb <[EMAIL PROTECTED]>
Only other choice seems to be to determine up front how many records we
are going to emit, but doing that is horrible compared to this just to
save one message. We already will usually have more than one audit
record.
Acked-by: Eric Paris <[EMAIL PROTECTED]>
>
>
> diff -urp linux-2.6.22.x86_64.orig/include/linux/audit.h
> linux-2.6.22.x86_64/include/linux/audit.h
> --- linux-2.6.22.x86_64.orig/include/linux/audit.h 2007-09-26
> 06:48:26.000000000 -0400
> +++ linux-2.6.22.x86_64/include/linux/audit.h 2007-09-26 06:40:25.000000000
> -0400
> @@ -96,6 +96,7 @@
> #define AUDIT_FD_PAIR 1317 /* audit record for
> pipe/socketpair */
> #define AUDIT_OBJ_PID 1318 /* ptrace target */
> #define AUDIT_TTY 1319 /* Input on an administrative TTY */
> +#define AUDIT_EOE 1320 /* End of multi-record event */
>
> #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
> #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
> diff -urp linux-2.6.22.x86_64.orig/kernel/auditsc.c
> linux-2.6.22.x86_64/kernel/auditsc.c
> --- linux-2.6.22.x86_64.orig/kernel/auditsc.c 2007-09-26 06:48:40.000000000
> -0400
> +++ linux-2.6.22.x86_64/kernel/auditsc.c 2007-09-26 06:46:59.000000000
> -0400
> @@ -1117,6 +1117,11 @@ static void audit_log_exit(struct audit_
>
> audit_log_end(ab);
> }
> +
> + /* Send end of event record to help user space know we are finished */
> + ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
> + if (ab)
> + audit_log_end(ab);
> if (call_panic)
> audit_panic("error converting sid to string");
> }
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
