On Wed, 2008-07-30 at 11:40 +0800, zhangxiliang wrote:
> In the audit message which type is "AUDIT_CONFIG_CHANGE", the output format
> should contain "auid" field.
shouldn't these be using the "audit_get_loginuid(current)" and if we
are going to output loginuid we also should be outputting sessionid
-Eric
>
> Signed-off-by: Zhang Xiliang <[EMAIL PROTECTED]>
> ---
> kernel/auditfilter.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> index 98c50cc..8a184f5 100644
> --- a/kernel/auditfilter.c
> +++ b/kernel/auditfilter.c
> @@ -1022,8 +1022,9 @@ static void audit_update_watch(struct audit_parent
> *parent,
> struct audit_buffer *ab;
> ab = audit_log_start(NULL, GFP_KERNEL,
> AUDIT_CONFIG_CHANGE);
> + audit_log_format(ab, "auid=%u", current->loginuid);
> audit_log_format(ab,
> - "op=updated rules specifying path=");
> + " op=updated rules specifying path=");
> audit_log_untrustedstring(ab, owatch->path);
> audit_log_format(ab, " with dev=%u ino=%lu\n",
> dev, ino);
> @@ -1058,7 +1059,8 @@ static void audit_remove_parent_watches(struct
> audit_parent *parent)
> struct audit_buffer *ab;
> ab = audit_log_start(NULL, GFP_KERNEL,
> AUDIT_CONFIG_CHANGE);
> - audit_log_format(ab, "op=remove rule path=");
> + audit_log_format(ab, "auid=%u",
> current->loginuid);
> + audit_log_format(ab, " op=remove rule path=");
> audit_log_untrustedstring(ab, w->path);
> if (r->filterkey) {
> audit_log_format(ab, " key=");
> --
> 1.5.4.2
>
>
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
