Commit 73e65b88 authored Mar 19, 2019 by Richard Guy Briggs Committed by Paul Moore Mar 20, 2019

audit: connect LOGIN record to its syscall record

Currently the AUDIT_LOGIN event is a standalone record that isn't
connected to any other records that may be part of its syscall event. To
avoid the confusion of generating two events, connect the records by
using its syscall context.

Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/110



Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent 95e0b46f

kernel/audit.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2220,7 +2220,7 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
		if (!audit_enabled)
		return;

		ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
		ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_LOGIN);
		if (!ab)
		return;

Admin message