GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-25 16:11:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[AUDIT] Add End of Event record

Browse source 
This patch adds an end of event record type. It will be sent by the kernel as
the last record when a multi-record event is triggered. This will aid realtime
analysis programs since they will now reliably know they have the last record
to complete an event. The audit daemon filters this and will not write it to
disk.

Signed-off-by: Steve Grubb <sgrubb redhat com>
Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Eric Paris 2008-01-07 13:49:15 -05:00 • committed by Al Viro
parent 4746ec5b01
commit c0641f28dc
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
kernel/auditsc.c
View file

@ -1270,6 +1270,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
audit_log_end(ab);
}
/* Send end of event record to help user space know we are finished */
ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
if (ab)
audit_log_end(ab);
if (call_panic)
audit_panic("error converting sid to string");
}