Re: [PATCH ghak90 V9 08/13] audit: add containerid support for user records

Add audit container identifier auxiliary record to user event standalone records. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Neil Horman <nhorman(a)tuxdriver.com&gt; Reviewed-by: Ondrej Mosnacek <omosnace(a)redhat.com&gt; --- kernel/audit.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 54dd2cb69402..997c34178ee8 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1507,6 +1504,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) audit_log_n_untrustedstring(ab, str, data_len); } audit_log_end(ab); + rcu_read_lock(); + cont = _audit_contobj_get(current); + rcu_read_unlock(); + audit_log_container_id(context, cont); + rcu_read_lock(); + _audit_contobj_put(cont); + rcu_read_unlock(); + audit_free_context(context);