[patch] fix syscall speedup patch mips typo

Steve Grubb sgrubb at redhat.com
Wed Mar 15 14:23:49 UTC 2006


On Monday 06 March 2006 10:32, Jason Baron wrote:
> The idea behind this patch is based on a suggestion to not call
> 'audit_syscall_entry' and 'audit_syscall_exit' if there are no audit rules
> loaded.

We are starting to get problem reports with this patch. It appears that
nothing sets ctime when the event is started via an avc. The patch below
takes a stab at fixing this. Does it look correct?

-Steve


diff -urp linux-2.6.15.x86_64.orig/kernel/auditsc.c linux-2.6.15.x86_64/kernel/auditsc.c
--- linux-2.6.15.x86_64.orig/kernel/auditsc.c	2006-03-15 09:09:25.000000000 -0500
+++ linux-2.6.15.x86_64/kernel/auditsc.c	2006-03-15 09:07:22.000000000 -0500
@@ -1136,6 +1136,8 @@ void auditsc_get_stamp(struct audit_cont
 {
 	if (!ctx->serial)
 		ctx->serial = audit_serial();
+	if (!ctx->ctime.tv_sec)
+		ctx->ctime = CURRENT_TIME;
 	t->tv_sec  = ctx->ctime.tv_sec;
 	t->tv_nsec = ctx->ctime.tv_nsec;
 	*serial    = ctx->serial;




More information about the Linux-audit mailing list