The following patch will return the data buffer for each rule
when listing the rules via AUDIT_LIST_RULES.
Signed-off-by: Darrel Goeddel <dgoeddel(a)trustedcs.com>
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index c895de7..c8af774 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -588,7 +588,7 @@ static int audit_list_rules(void *_dest)
if (unlikely(!data))
break;
audit_send_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
- data, sizeof(*data));
+ data, sizeof(*data) + data->buflen);
kfree(data);
}
}
--
Darrel