On Tue, Feb 5, 2019 at 5:19 PM Richard Guy Briggs <rgb(a)redhat.com> wrote:
AUDIT_TTY records were logged as seperate events from their syscall
records. Join them so they are logged as the single event that they
are.
Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/106
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
Tested with ausearch-test-0.6 and audit-testsuite, manually inspected
for record association.
drivers/tty/tty_audit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Merged into audit/next.
--
paul moore
www.paul-moore.com