audit: simplify audit_enabled check in audit_watch_log_rule_change() (4fa7f086) · Commits · 戴 / test

Check the audit_enabled flag and bail immediately. This does not change the functionality, but brings the code format in line with similar checks in audit_tree_log_remove_rule(), audit_mark_log_rule_change(), and elsewhere in the audit code. See: https://github.com/linux-audit/audit-kernel/issues/50 Signed-off-by:

Richard Guy Briggs <rgb@redhat.com> [PM: tweaked subject line] Signed-off-by:

Paul Moore <paul@paul-moore.com>

kernel/audit_watch.c

+15 −14

Original line number	Diff line number	Diff line
		@@ -238,10 +238,12 @@ out:

		static void audit_watch_log_rule_change(struct audit_krule r, struct audit_watch w, char *op)
		{
		if (audit_enabled) {
		struct audit_buffer *ab;

		if (!audit_enabled)
		return;
		ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE);
		if (unlikely(!ab))
		if (!ab)
		return;
		audit_log_format(ab, "auid=%u ses=%u op=%s",
		from_kuid(&init_user_ns, audit_get_loginuid(current)),
		@@ -252,7 +254,6 @@ static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watc
		audit_log_format(ab, " list=%d res=1", r->listnr);
		audit_log_end(ab);
		}
		}

		/* Update inode info in audit rules based on filesystem event. */
		static void audit_update_watch(struct audit_parent *parent,

Admin message