On Thu, 2005-06-23 at 14:49 +0100, David Woodhouse wrote:
I'm testing a fix for this now...
Appears to work. Building audit.67 now...
--- kernel/auditsc.c~ 2005-06-21 16:30:59.000000000 +0100
+++ kernel/auditsc.c 2005-06-23 14:45:43.000000000 +0100
@@ -573,7 +584,7 @@ static inline struct audit_context *audi
context->return_valid = return_valid;
context->return_code = return_code;
- if (context->in_syscall && !context->auditable) {
+ if (context->in_syscall && !context->auditable && tsk->pid !=
audit_pid) {
enum audit_state state;
state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
if (state == AUDIT_RECORD_CONTEXT)
--
dwmw2