Re: [PATCH ghak59 V3 2/4] audit: add syscall information to CONFIG_CHANGE records

Tie syscall information to all CONFIG_CHANGE calls since they are all a result of user actions. Exclude user records from syscall context: Since the function audit_log_common_recv_msg() is shared by a number of AUDIT_CONFIG_CHANGE and the entire range of AUDIT_USER_* record types, and since the AUDIT_CONFIG_CHANGE message type has been converted to a syscall accompanied record type, special-case the AUDIT_USER_* range of messages so they remain standalone records. See: https://github.com/linux-audit/audit-kernel/issues/59 See: https://github.com/linux-audit/audit-kernel/issues/50 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- kernel/audit.c | 27 +++++++++++++++++++-------- kernel/audit_fsnotify.c | 2 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 2 +- kernel/auditfilter.c | 2 +- 5 files changed, 23 insertions(+), 12 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 0e8026423fbd..a321fea94cc6 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1072,6 +1073,16 @@ static void audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type) audit_log_task_context(*ab); } +static inline void audit_log_user_recv_msg(struct audit_buffer **ab, u16 msg_type) +{ + audit_log_common_recv_msg(NULL, ab, msg_type); +}

+static inline void audit_log_config_change_alt(struct audit_buffer **ab) +{ + audit_log_common_recv_msg(audit_context(), ab, AUDIT_CONFIG_CHANGE); +}