From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paul Moore <paul.moore@hp.com>
Subject: Re: [PATCH] Audit: EINTR instead of kernel private return codes in
	audit records
Date: Wed, 14 Nov 2007 15:29:18 -0500
Message-ID: <200711141529.18883.paul.moore@hp.com>
References: <1195071728.2924.40.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1195071728.2924.40.camel@localhost.localdomain>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday 14 November 2007 3:22:08 pm Eric Paris wrote:
> When a syscall gets interrupted by a signal and that signal is set to
> not restart the syscall its return code will get collected by the audit
> system before the registers are changed to the userspace valid EINTR;
> See the discussion in include/linux/errno.h

I have no idea if the fix is the "right way" of dealing with the problem (I'll 
let the audit experts vote on that), but thanks for looking into the problem 
and coming up with a possible solution.

-- 
paul moore
linux security @ hp