Re: [PATCH] audit: add arch field to seccomp event log

> missing '=' but this isn't what audit_get_context() does... it's > crappy naming... I'd think a combo of audit_dummy_context() and > current->audit_context would be most appropriate. Ok. I think I finally understand audit_dummy_context(). Thanks for the hint. However, it appears it is not useful in this sitation, since if there is an audit_context, even a dummy context, it appears arch is filled in. diff --git a/kernel/auditsc.c b/kernel/auditsc.c @@ -2406,12 +2406,18 @@ void audit_core_dumps(long signr) void __audit_seccomp(unsigned long syscall, long signr, int code) { struct audit_buffer *ab; + struct audit_context *context = current->audit_context; ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_SECCOMP); if (unlikely(!ab)) return; audit_log_task(ab); audit_log_format(ab, " sig=%ld", signr); + audit_log_format(ab, " arch="); + if (context) + audit_log_format(ab, "%x", context->arch); + else + audit_log_format(ab, "(null)"); audit_log_format(ab, " syscall=%ld", syscall); audit_log_format(ab, " compat=%d", is_compat_task()); audit_log_format(ab, " ip=0x%lx", KSTK_EIP(current));