From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: Audit issue
Date: Thu, 08 Nov 2007 09:35:01 -0500
Message-ID: <1194532501.5429.1.camel@localhost.localdomain>
References: <200710301248.24261.sgrubb@redhat.com>
	<200710311740.19981.sgrubb@redhat.com>
	<20071108141926.GA28304@devserv.devel.redhat.com>
	<200711080927.14472.sgrubb@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200711080927.14472.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com


On Thu, 2007-11-08 at 09:27 -0500, Steve Grubb wrote:
> On Thursday 08 November 2007 09:19:26 Alexander Viro wrote:
> > Have fun...
> 
> Thanks for posting this patch. Is it impossible to "repair " processes by 
> simply adding a context if the pointer is NULL?
> 
> 
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index f93c271..83227f8 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -70,6 +70,7 @@ static int	audit_initialized;
> >   * 1 - auditing enabled
> >   * 2 - auditing enabled and configuration is locked/unchangeable. */
> >  int		audit_enabled;
> > +int		audit_ever_enabled;
> >
> >  /* Default state when kernel boots without any parameters. */
> >  static int	audit_default;
> > @@ -965,6 +968,7 @@ static int __init audit_init(void)
> >  	skb_queue_head_init(&audit_skb_queue);
> >  	audit_initialized = 1;
> >  	audit_enabled = audit_default;
> > +	audit_ever_enabled |= !!audit_default;
> 
> Should the declaration of audit_ever_enabled set a default value like 0 since 
> this is being or'ed in? Or should this just be an assignment?

No, global defined variables like this are initialized to 0 in the
kernel.  So this already does what you are thinking.

-Eric