On Thu, May 13, 2021 at 4:31 PM Casey Schaufler <ca...@schaufler-ca.com> wrote: > > Standalone audit records have the timestamp and serial number generated > on the fly and as such are unique, making them standalone. This new > function audit_alloc_local() generates a local audit context that will > be used only for a standalone record and its auxiliary record(s). The > context is discarded immediately after the local associated records are > produced. > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > Signed-off-by: Casey Schaufler <ca...@schaufler-ca.com> > Cc: linux-audit@redhat.com > To: Richard Guy Briggs <r...@redhat.com> > --- > include/linux/audit.h | 8 ++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- > 3 files changed, 37 insertions(+), 5 deletions(-)
At some point I suspect we will need to add filtering for these "local" records, but that is a problem for another day. Acked-by: Paul Moore <p...@paul-moore.com> -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
