提交 e445deb5 编写于 作者: E Eric Paris 提交者: Al Viro

[AUDIT] include audit type in audit message when using printk

Currently audit drops the audit type when an audit message goes through
printk instead of the audit deamon.  This is a minor annoyance in
that the audit type is no longer part of the message and the information
the audit type conveys needs to be carried in, or derived from the
message data.

The attached patch includes the type number as part of the printk.
Admittedly it isn't the type name that the audit deamon provides but I
think this is better than dropping the type completely.
Signed-pff-by: NJohn Johansen <jjohansen@suse.de>
Signed-off-by: NEric Paris <eparis@redhat.com>
上级 6246ccab
......@@ -1438,7 +1438,8 @@ void audit_log_end(struct audit_buffer *ab)
ab->skb = NULL;
wake_up_interruptible(&kauditd_wait);
} else {
printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
}
}
audit_buffer_free(ab);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册