* [PATCH 1/1] audit: Make AUDIT_KERNEL event conform to the specification
@ 2016-12-01 20:02 Steve Grubb
2016-12-02 20:46 ` Paul Moore
0 siblings, 1 reply; 2+ messages in thread
From: Steve Grubb @ 2016-12-01 20:02 UTC (permalink / raw)
To: linux-audit
The AUDIT_KERNEL event is not following name=value format. This causes
some information to get lost. The event has been reformatted to follow
the convention. Additionally the audit_enabled value was added for
troubleshooting purposes. The following is an example of the new event:
type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1
Signed-off-by: sgrubb <sgrubb@redhat.com>
---
kernel/audit.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/audit.c b/kernel/audit.c
index 910a7c1..91860d4 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1252,7 +1252,9 @@ static int __init audit_init(void)
audit_enabled = audit_default;
audit_ever_enabled |= !!audit_default;
- audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+ audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
+ "state=initialized audit_enabled=%u res=1",
+ audit_enabled);
for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
INIT_LIST_HEAD(&audit_inode_hash[i]);
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] audit: Make AUDIT_KERNEL event conform to the specification
2016-12-01 20:02 [PATCH 1/1] audit: Make AUDIT_KERNEL event conform to the specification Steve Grubb
@ 2016-12-02 20:46 ` Paul Moore
0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2016-12-02 20:46 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
On Thu, Dec 1, 2016 at 3:02 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> The AUDIT_KERNEL event is not following name=value format. This causes
> some information to get lost. The event has been reformatted to follow
> the convention. Additionally the audit_enabled value was added for
> troubleshooting purposes. The following is an example of the new event:
>
> type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1
>
> Signed-off-by: sgrubb <sgrubb@redhat.com>
> ---
> kernel/audit.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Looks reasonable. I fixed your name (sgrubb -> Steve Grubb) and
merged this into my next queue for after the upcoming merge window.
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 910a7c1..91860d4 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1252,7 +1252,9 @@ static int __init audit_init(void)
> audit_enabled = audit_default;
> audit_ever_enabled |= !!audit_default;
>
> - audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
> + audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
> + "state=initialized audit_enabled=%u res=1",
> + audit_enabled);
>
> for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
> INIT_LIST_HEAD(&audit_inode_hash[i]);
> --
> 2.7.4
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-12-02 20:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-01 20:02 [PATCH 1/1] audit: Make AUDIT_KERNEL event conform to the specification Steve Grubb
2016-12-02 20:46 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.