From mboxrd@z Thu Jan  1 00:00:00 1970
From: LC Bruzenak <lenny@magitekltd.com>
Subject: Re: [PATCH] Fixed reason field in audit signal logging
Date: Thu, 07 Nov 2013 08:52:21 -0600
Message-ID: <527BA925.9030305@magitekltd.com>
References: <20131107133932.GA10317@pauldc-Inspiron-1470>
	<1383835404.2938.38.camel@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com
	[10.5.110.21])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id rA7EqOeB020420
	for <linux-audit@redhat.com>; Thu, 7 Nov 2013 09:52:24 -0500
Received: from mail-oa0-f51.google.com (mail-oa0-f51.google.com
	[209.85.219.51])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA7EqNkJ021959
	for <linux-audit@redhat.com>; Thu, 7 Nov 2013 09:52:23 -0500
Received: by mail-oa0-f51.google.com with SMTP id o6so1087896oag.10
	for <linux-audit@redhat.com>; Thu, 07 Nov 2013 06:52:23 -0800 (PST)
Received: from [192.168.31.11] (108-252-2-157.lightspeed.austtx.sbcglobal.net.
	[108.252.2.157])
	by mx.google.com with ESMTPSA id j9sm4152427oef.8.2013.11.07.06.52.22
	for <linux-audit@redhat.com>
	(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
	Thu, 07 Nov 2013 06:52:22 -0800 (PST)
In-Reply-To: <1383835404.2938.38.camel@localhost>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On 11/07/2013 08:43 AM, Eric Paris wrote:
> On Thu, 2013-11-07 at 19:09 +0530, Paul Davies C wrote:
>> The audit system logs the signals that leads to abnormal end of a process.
>> However , as of now , it always states the reason for failure of a process as
>> "memory violation" regardless of the signal delivered. This is due to the
>> audit_core_dumps() function pass the reason for failure blindly to the
>> audit_log_abend() as "memory violation".
>>
>> This patch changes the audit_core_dumps() function as to pass on the right
>> reason to the audit_log_abend based on the signal received.
>>
>> Signed-off-by:Paul Davies C
> Acked-by: Eric Paris <eparis@redhat.com>
>
> But we really should wait for an Ack and thoughts from steve grubb....
>
FWIW I really like this fix. It will be valuable to me (once I get it in
my RHEL-6.2 systems); thanks!

LCB

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com