[PATCH 1/1] audit: Make AUDIT_ANOM_ABEND event normalized

[PATCH 1/1] audit: Make AUDIT_ANOM_ABEND event normalized

[Steve Grubb]

The audit event specification asks for certain fields to exist in
all events. Running 'ausearch -m anom_abend -sv yes' returns no
events. This patch adds the result field so that the
AUDIT_ANOM_ABEND event conforms to the rules.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
---
 kernel/auditsc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 5abf1dc..4317f5b 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2403,7 +2403,7 @@ void audit_core_dumps(long signr)
 	if (unlikely(!ab))
 		return;
 	audit_log_task(ab);
-	audit_log_format(ab, " sig=%ld", signr);
+	audit_log_format(ab, " sig=%ld res=1", signr);
 	audit_log_end(ab);
 }
 
-- 
2.7.4

Re: [PATCH 1/1] audit: Make AUDIT_ANOM_ABEND event normalized

[Paul Moore]

On Thu, Dec 8, 2016 at 1:55 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> The audit event specification asks for certain fields to exist in
> all events. Running 'ausearch -m anom_abend -sv yes' returns no
> events. This patch adds the result field so that the
> AUDIT_ANOM_ABEND event conforms to the rules.
>
> Signed-off-by: Steve Grubb <sgrubb@redhat.com>
> ---
>  kernel/auditsc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Looks good to me, added to the queue of patches to merge after the
upcoming merge window.

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 5abf1dc..4317f5b 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2403,7 +2403,7 @@ void audit_core_dumps(long signr)
>         if (unlikely(!ab))
>                 return;
>         audit_log_task(ab);
> -       audit_log_format(ab, " sig=%ld", signr);
> +       audit_log_format(ab, " sig=%ld res=1", signr);
>         audit_log_end(ab);
>  }
>
> --
> 2.7.4
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

-- 
paul moore
www.paul-moore.com