lkml.org 
[lkml]   [2022]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 2/2] audit: add filterkey to special audit messages
On Tue, May 3, 2022 at 5:02 AM Sven Schnelle <svens@linux.ibm.com> wrote:
>
> For automated filtering/testing it is useful to have the
> filter key logged in the message.
>
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
> ---
> kernel/auditsc.c | 1 +
> 1 file changed, 1 insertion(+)

The SOCKETCALL record, along with all of the others generated inside
show_special(), are associated with a SYSCALL record which carries the
"key=" field. As a general rule we try very hard not to duplicate
fields across records in a single audit event.

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index c856893041c9..2e349660a56f 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1508,6 +1508,7 @@ static void show_special(struct audit_context *context, int *call_panic)
> audit_log_time(context, &ab);
> break;
> }
> + audit_log_key(ab, context->filterkey);
> audit_log_end(ab);
> }
>
> --
> 2.32.0

--
paul-moore.com

\
 
 \ /
  Last update: 2022-05-03 18:58    [W:0.089 / U:1.388 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site