[AUDIT] return EINTR not ERESTART* (f701b75e) · Commits · 戴 / test

The syscall exit code will change ERESTART* kernel internal return codes to EINTR if it does not restart the syscall. Since we collect the audit info before that point we should fix those in the audit log as well. Signed-off-by:

Eric Paris <eparis@redhat.com>

kernel/auditsc.c

+18 −1

Original line number	Diff line number	Diff line
		@@ -701,6 +701,23 @@ static inline struct audit_context audit_get_context(struct task_struct tsk,
		if (likely(!context))
		return NULL;
		context->return_valid = return_valid;

		/*
		* we need to fix up the return code in the audit logs if the actual
		* return codes are later going to be fixed up by the arch specific
		* signal handlers
		*
		* This is actually a test for:
		* (rc == ERESTARTSYS ) \|\| (rc == ERESTARTNOINTR) \|\|
		* (rc == ERESTARTNOHAND) \|\| (rc == ERESTART_RESTARTBLOCK)
		*
		* but is faster than a bunch of \|\|
		*/
		if (unlikely(return_code <= -ERESTARTSYS) &&
		(return_code >= -ERESTART_RESTARTBLOCK) &&
		(return_code != -ENOIOCTLCMD))
		context->return_code = -EINTR;
		else
		context->return_code = return_code;

		if (context->in_syscall && !context->dummy && !context->auditable) {

Admin message