Re: [PATCH] Audit: EINTR instead of kernel private return codes in audit records
On Wednesday 14 November 2007 3:22:08 pm Eric Paris wrote:
When a syscall gets interrupted by a signal and that signal is set
to
not restart the syscall its return code will get collected by the audit
system before the registers are changed to the userspace valid EINTR;
See the discussion in include/linux/errno.h
I have no idea if the fix is the "right way" of dealing with the problem
(I'll
let the audit experts vote on that), but thanks for looking into the problem
and coming up with a possible solution.
--
paul moore
linux security @ hp