Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c0641f28dcbecb6dc34a4fd003a9947fcd080696
Commit: c0641f28dcbecb6dc34a4fd003a9947fcd080696
Parent: 4746ec5b01ed07205a91e4f7ed9de9d70f371407
Author: Eric Paris <[EMAIL PROTECTED]>
AuthorDate: Mon Jan 7 13:49:15 2008 -0500
Committer: Al Viro <[EMAIL PROTECTED]>
CommitDate: Fri Feb 1 14:07:19 2008 -0500
[AUDIT] Add End of Event record
This patch adds an end of event record type. It will be sent by the kernel
as
the last record when a multi-record event is triggered. This will aid
realtime
analysis programs since they will now reliably know they have the last
record
to complete an event. The audit daemon filters this and will not write it to
disk.
Signed-off-by: Steve Grubb <sgrubb redhat com>
Signed-off-by: Eric Paris <[EMAIL PROTECTED]>
---
include/linux/audit.h | 1 +
kernel/auditsc.c | 5 +++++
2 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 52f1b12..4d1c2f2 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -98,6 +98,7 @@
#define AUDIT_FD_PAIR 1317 /* audit record for pipe/socketpair */
#define AUDIT_OBJ_PID 1318 /* ptrace target */
#define AUDIT_TTY 1319 /* Input on an administrative TTY */
+#define AUDIT_EOE 1320 /* End of multi-record event */
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e67abb..6e5de76 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1270,6 +1270,11 @@ static void audit_log_exit(struct audit_context
*context, struct task_struct *ts
audit_log_end(ab);
}
+
+ /* Send end of event record to help user space know we are finished */
+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+ if (ab)
+ audit_log_end(ab);
if (call_panic)
audit_panic("error converting sid to string");
}
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
