From: Miloslav Trmač <m...@redhat.com> Add SELinux context information and TTY name (consistent with the AUDIT_SYSCALL record) to AUDIT_TTY. An example record after applying this patch:
type=TTY msg=audit(1237480806.220:22): tty pid=2601 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 major=136 minor=1 tty=pts1 comm="bash" data=6361740D (line wrapped, new fields are "subj" and "tty".) Signed-off-by: Miloslav Trmač <m...@redhat.com> --- drivers/char/tty_audit.c | 57 ++++++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 19 deletions(-)
audit-tty-more-fields.patch
Description: Binary data
-- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
