Re: [PATCH V2 ghak120] audit: trigger accompanying records when no rules present

When there are no audit rules registered, mandatory records (config, etc.) are missing their accompanying records (syscall, proctitle, etc.). This is due to audit context dummy set on syscall entry based on absence of rules that signals that no other records are to be printed. Clear the dummy bit if any record is generated. The proctitle context and dummy checks are pointless since the proctitle record will not be printed if no syscall records are printed. Please see upstream github issue https://github.com/linux-audit/audit-kernel/issues/120 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- Chagelog: v2: - unconditionally clear dummy - create audit_clear_dummy accessor function - remove proctitle context and dummy checks --- kernel/audit.c | 1 + kernel/audit.h | 8 ++++++++ kernel/auditsc.c | 3 --- 3 files changed, 9 insertions(+), 3 deletions(-)