From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Davies C Subject: [PATCH] Fixed reason field in audit signal logging Date: Thu, 7 Nov 2013 19:09:32 +0530 Message-ID: <20131107133932.GA10317@pauldc-Inspiron-1470> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com, viro@zeniv.linux.org.uk, eparis@redhat.com List-Id: linux-audit@redhat.com The audit system logs the signals that leads to abnormal end of a process. However , as of now , it always states the reason for failure of a process as "memory violation" regardless of the signal delivered. This is due to the audit_core_dumps() function pass the reason for failure blindly to the audit_log_abend() as "memory violation". This patch changes the audit_core_dumps() function as to pass on the right reason to the audit_log_abend based on the signal received. Signed-off-by:Paul Davies C --- kernel/auditsc.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 9845cb3..3cafd13 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2395,7 +2395,36 @@ void audit_core_dumps(long signr) ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); if (unlikely(!ab)) return; - audit_log_abend(ab, "memory violation", signr); + + /*Identify the reason for failure based on signal delivered.*/ + switch (signr) { + case SIGABRT: + audit_log_abend(ab, "received abort", signr); + break; + case SIGBUS: + audit_log_abend(ab, "invalid pointer dereference", signr); + break; + case SIGFPE: + audit_log_abend(ab, "invalid floating point instruction", signr); + break; + case SIGILL: + audit_log_abend(ab, "illegal instruction", signr); + break; + case SIGSEGV: + audit_log_abend(ab, "memory violation", signr); + break; + case SIGTRAP: + audit_log_abend(ab, "bad instruction / debugger generated signal", signr); + break; + case SIGXCPU: + audit_log_abend(ab, "cpu time violation", signr); + break; + case SIGXFSZ: + audit_log_abend(ab, "file size violation", signr); + break; + default: + audit_log_abend(ab, "not defined", signr); + } audit_log_end(ab); } -- 1.7.9.5