Quoting Richard Guy Briggs (r...@redhat.com): > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > --- > include/uapi/linux/audit.h | 2 ++ > kernel/audit.c | 2 ++ > 2 files changed, 4 insertions(+), 0 deletions(-) > > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 7ec7209..beb23f7 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -163,6 +163,8 @@ > > #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A > REQUEST. */ > > +#define AUDIT_VIRT_CONTROL 2500 /* Start, Pause, Stop VM */ > + > /* Rule flags */ > #define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated > messages */ > #define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not > syscall) */ > diff --git a/kernel/audit.c b/kernel/audit.c > index 84590d1..5404c24 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -941,6 +941,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct > nlmsghdr *nlh) > } > audit_set_portid(ab, NETLINK_CB(skb).portid); > audit_log_end(ab); > + if (msg_type == AUDIT_VIRT_CONTROL) > + audit_log_ns_info(NULL);
AFAICT your patchset leaves audit_log_ns_info() immediately returning if arg1 is NULL. Is handling that coming later? Why not leave this until that patch comes? > mutex_lock(&audit_cmd_mutex); > } > break; > -- > 1.7.1 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
