From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Johansen Subject: [RFC] include audit type in audit message when using printk Date: Sat, 1 Sep 2007 12:22:47 -0700 Message-ID: <20070901192247.GA22366@suse.de> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1044379643==" Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l81JOVSF021273 for ; Sat, 1 Sep 2007 15:24:32 -0400 Received: from mx1.suse.de (cantor.suse.de [195.135.220.2]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l81JOOjZ030201 for ; Sat, 1 Sep 2007 15:24:24 -0400 Received: from Relay1.suse.de (mail2.suse.de [195.135.221.8]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.suse.de (Postfix) with ESMTP id D4959122E5 for ; Sat, 1 Sep 2007 21:24:18 +0200 (CEST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1044379643== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="wRRV7LY7NUeQGEoC" Content-Disposition: inline --wRRV7LY7NUeQGEoC Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Currently audit drops the audit type when an audit message goes through printk instead of the audit deamon. This is a minor annoyance in that the audit type is no longer part of the message and the information the audit type conveys needs to be carried in, or derived from the message data. The attached patch includes the type number as part of the printk. Admittedly it isn't the type name that the audit deamon provides but I think this is better than dropping the type completely. --- kernel/audit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1354,7 +1354,8 @@ void audit_log_end(struct audit_buffer * ab->skb = NULL; wake_up_interruptible(&kauditd_wait); } else { - printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0)); + struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); + printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0)); } } audit_buffer_free(ab); --wRRV7LY7NUeQGEoC Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFG2bwHi/GH5xuqKCcRAt0+AJ9OpNjTpBFPynnzytFlcjJdiP6LygCfQPpV B94IskkqnLbilahcr/GenMA= =1czG -----END PGP SIGNATURE----- --wRRV7LY7NUeQGEoC-- --===============1044379643== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1044379643==--