aboutsummaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2008-01-07 13:49:15 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2008-02-01 14:07:19 -0500
commitc0641f28dcbecb6dc34a4fd003a9947fcd080696 (patch)
tree75cc2700afe2e83834895e7f45c7f663faf2e034 /kernel
parent4746ec5b01ed07205a91e4f7ed9de9d70f371407 (diff)
[AUDIT] Add End of Event record
This patch adds an end of event record type. It will be sent by the kernel as the last record when a multi-record event is triggered. This will aid realtime analysis programs since they will now reliably know they have the last record to complete an event. The audit daemon filters this and will not write it to disk. Signed-off-by: Steve Grubb <sgrubb redhat com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/auditsc.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e67abb0290..6e5de767bad 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1270,6 +1270,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
audit_log_end(ab);
}
+
+ /* Send end of event record to help user space know we are finished */
+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+ if (ab)
+ audit_log_end(ab);
if (call_panic)
audit_panic("error converting sid to string");
}