From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: [PATCH 1/1] audit: Make AUDIT_ANOM_ABEND event normalized Date: Thu, 08 Dec 2016 13:55:08 -0500 Message-ID: <1547916.CxkrPjAzLT@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from x2.localnet (vpn-63-50.rdu2.redhat.com [10.10.63.50]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uB8It9qC008611 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 8 Dec 2016 13:55:09 -0500 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com The audit event specification asks for certain fields to exist in all events. Running 'ausearch -m anom_abend -sv yes' returns no events. This patch adds the result field so that the AUDIT_ANOM_ABEND event conforms to the rules. Signed-off-by: Steve Grubb --- kernel/auditsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 5abf1dc..4317f5b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2403,7 +2403,7 @@ void audit_core_dumps(long signr) if (unlikely(!ab)) return; audit_log_task(ab); - audit_log_format(ab, " sig=%ld", signr); + audit_log_format(ab, " sig=%ld res=1", signr); audit_log_end(ab); } -- 2.7.4