[patch] Syscall auditing - move "name=" field to the end

Ondrej Zary
2005-03-16T21:38:06Z

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

This patch moves the "name=" field to the end of audit records. The
original placement is bad because it cannot be properly parsed. It is
impossible to tell if the name is "/bin/true" or "/bin/true inode=469634
dev=00:00" because the "inode=" and "dev=" fields can be omitted.

Before:
audit(1111008486.824:89346): item=0 name=/bin/true inode=469634 dev=00:00

After:
audit(1111008486.824:89346): item=0 inode=469634 dev=00:00 name=/bin/true

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>

--
Ondrej Zary

[-- Attachment #2: auditsc_move_name_to_end_of_record.patch --]
[-- Type: text/plain, Size: 750 bytes --]

--- linux-2.6.11/kernel/auditsc.c~ 2005-03-16 22:13:22.000000000 +0100
+++ linux-2.6.11/kernel/auditsc.c 2005-03-16 22:13:22.000000000 +0100
@@ -612,9 +612,6 @@
if (!ab)
continue; /* audit_panic has been called */
audit_log_format(ab, "item=%d", i);
- if (context->names[i].name)
- audit_log_format(ab, " name=%s",
- context->names[i].name);
if (context->names[i].ino != (unsigned long)-1)
audit_log_format(ab, " inode=%lu",
context->names[i].ino);
@@ -624,6 +621,9 @@
audit_log_format(ab, " dev=%02x:%02x",
MAJOR(context->names[i].rdev),
MINOR(context->names[i].rdev));
+ if (context->names[i].name)
+ audit_log_format(ab, " name=%s",
+ context->names[i].name);
audit_log_end(ab);
}
}