提交 7c397d01 编写于 作者: S Steve Grubb 提交者: Paul Moore

audit: Make AUDIT_KERNEL event conform to the specification

The AUDIT_KERNEL event is not following name=value format. This causes
some information to get lost. The event has been reformatted to follow
the convention. Additionally the audit_enabled value was added for
troubleshooting purposes. The following is an example of the new event:

  type=KERNEL audit(1480621249.833:1): state=initialized
              audit_enabled=0 res=1
Signed-off-by: NSteve Grubb <sgrubb@redhat.com>
[PM: commit tweaks to make checkpatch.pl happy]
Signed-off-by: NPaul Moore <paul@paul-moore.com>
上级 533c7b69
...@@ -1344,7 +1344,9 @@ static int __init audit_init(void) ...@@ -1344,7 +1344,9 @@ static int __init audit_init(void)
panic("audit: failed to start the kauditd thread (%d)\n", err); panic("audit: failed to start the kauditd thread (%d)\n", err);
} }
audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
"state=initialized audit_enabled=%u res=1",
audit_enabled);
return 0; return 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册