Re: [PATCH ghak138 v2 4/4] audit: move audit_return_fixup before the filters
On Thu, Aug 25, 2022 at 3:33 PM Richard Guy Briggs <rgb(a)redhat.com> wrote:
The success and return_code are needed by the filters. Move
audit_return_fixup() before the filters. This was causing syscall
auditing events to be missed.
Link: https://github.com/linux-audit/audit-kernel/issues/138
Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts
beyond syscalls")
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
kernel/auditsc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
This looks better. Merged into audit/stable-6.0 and assuming the
automated testing goes well I'll send it to Linus shortly afterward.
--
paul-moore.com