On 18/06/2018 20:35, Richard Guy Briggs wrote: > > Nice catch. > > This doesn't quite look right though. What if audit_get_nd() fails?
Oh, yes, obviously. I don't know why I thought there was a goto instead of a return there. > How about we put that audit_get_watch(watch) right before > audit_find_parent()? > Sure, I will send a V2. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
