Move the access to the entry for audit_match_signal() to the beginning of the
function in case the entry found is the same one passed in. This will enable
it to be used by audit_remove_mark_rule().
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
This might benefit from a flag to tell it to delete the entry handed it rather
than searching for an identical one.
---
kernel/auditfilter.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 30091ce..9b2db56 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -990,6 +990,7 @@ int audit_del_rule(struct audit_entry *entry)
int ret = 0;
#ifdef CONFIG_AUDITSYSCALL
int dont_count = 0;
+ int match = audit_match_signal(entry);
/* If either of these, don't count towards total */
if (entry->rule.listnr == AUDIT_FILTER_USER ||
@@ -1021,7 +1022,7 @@ int audit_del_rule(struct audit_entry *entry)
if (!dont_count)
audit_n_rules--;
- if (!audit_match_signal(entry))
+ if (!match)
audit_signals--;
#endif
mutex_unlock(&audit_filter_mutex);
--
1.7.1