Re: [PATCH] Prevent per,success and exit fields from disappearing in syscall audit log

[Steve Grubb <sgrubb@redhat.com>]

On Mon, 20 Jan 2014 18:50:43 +0530
Paul Davies C <pauldaviesc@gmail.com> wrote:

> This patch prevents the per, success and the exit fields from
> disappearing from the audit system call log.

(null) is an unrecognized value for all these fields. It would be
invalid for all currently written software that processes logs.

Also, there is a reason why a check for return valid exists. Once upon
a time about 5-6 years ago, it was found that we can actually get a
syscall record where the return is not valid. You'd have to search the
archives to see what caused the patch to be written

-Steve

> Signed-off-by: Paul Davies C <pauldaviesc@gmail.com>
> ---
>  kernel/auditsc.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 9845cb3..3871466 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1300,10 +1300,14 @@ static void audit_log_exit(struct
> audit_context *context, struct task_struct *ts context->arch,
> context->major); if (context->personality != PER_LINUX)
>  		audit_log_format(ab, " per=%lx",
> context->personality);
> +	else
> +		audit_log_format(ab, " per=(null)");
>  	if (context->return_valid)
>  		audit_log_format(ab, " success=%s exit=%ld",
>  				 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
>  				 context->return_code);
> +	else
> +		audit_log_format(ab, " success=(null) exit=(null)");
>  
>  	audit_log_format(ab,
>  			 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",