[PATCH] Audit: EINTR instead of kernel private return codes in audit records
When a syscall gets interrupted by a signal and that signal is set to
not restart the syscall its return code will get collected by the audit
system before the registers are changed to the userspace valid EINTR;
See the discussion in include/linux/errno.h
Thus it is possible to get a syscall audit such as:
type=SYSCALL msg=audit(11/13/2007 23:47:34.648:80314) : arch=x86_64
syscall=accept success=no exit=-512(Unknown error 512) a0=3 [snip]
with this patch we clean up those kernel only return codes and give the
userspace equivalent.
type=SYSCALL msg=audit(11/13/2007 23:06:04.017:898) : arch=x86_64
syscall=accept success=no exit=-4(Interrupted system call) a0=3 [snip]
Signed-off-by: Eric Paris <eparis(a)redhat.com>
---
kernel/auditsc.c | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index bce9ecd..447ad65 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -702,7 +702,14 @@ static inline struct audit_context *audit_get_context(struct
task_struct *tsk,
if (likely(!context))
return NULL;
context->return_valid = return_valid;
- context->return_code = return_code;
+
+ if (unlikely((return_code == -ERESTART_RESTARTBLOCK) ||
+ (return_code == -ERESTARTNOHAND) ||
+ (return_code == -ERESTARTSYS) ||
+ (return_code == -ERESTARTNOINTR)))
+ context->return_code = -EINTR;
+ else
+ context->return_code = return_code;
if (context->in_syscall && !context->dummy &&
!context->auditable) {
enum audit_state state;