Re: [RFC PATCH ghak32 V2 09/13] audit: add containerid support for config/feature/user records

On 2018-04-18 21:27, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > Add container ID auxiliary records to configuration change, feature set change > > and user generated standalone records. > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > > kernel/audit.c | 50 ++++++++++++++++++++++++++++++++++++++++---------- > > kernel/auditfilter.c | 5 ++++- > > 2 files changed, 44 insertions(+), 11 deletions(-) > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > index b238be5..08662b4 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -400,8 +400,9 @@ static int audit_log_config_change(char *function_name, u32 new, u32 old, > > { > > struct audit_buffer *ab; > > int rc = 0; > > + struct audit_context *context = audit_alloc_local(); > > We should be able to use current->audit_context here right? If we > can't for every caller, perhaps we pass an audit_context as an > argument and only allocate a local context when the passed > audit_context is NULL. > > Also, if you're not comfortable always using current, just pass the > audit_context as you do with audit_log_common_recv_msg(). As mentioned in the tree/watch/mark patch, this is all obsoleted by making the AUDIT_CONFIG_CHANGE record a SYSCALL auxiliary record.

This review would have been more helpful a month and a half ago.