Since only one of val, uid and gid are used at any given time, combine them to
reduce the size of the struct audit_field.
Signed-off-by: Richard Guy Briggs <r...@redhat.com>
---
include/linux/audit.h | 8 +++++---
kernel/auditfilter.c | 2 --
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 1ae0089..06141b3 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -66,9 +66,11 @@ struct audit_krule {
struct audit_field {
u32 type;
- u32 val;
- kuid_t uid;
- kgid_t gid;
+ union {
+ u32 val;
+ kuid_t uid;
+ kgid_t gid;
+ };
u32 op;
char *lsm_str;
void *lsm_rule;
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index b65a138..ea8d389 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -422,8 +422,6 @@ static struct audit_entry *audit_data_to_entry(struct
audit_rule_data *data,
f->type = data->fields[i];
f->val = data->values[i];
- f->uid = INVALID_UID;
- f->gid = INVALID_GID;
f->lsm_str = NULL;
f->lsm_rule = NULL;
--
1.7.1
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
