[PATCH] Audit: EINTR instead of kernel private return codes in audit records

[Paul Moore]

On Wednesday 14 November 2007 3:22:08 pm Eric Paris wrote:
> When a syscall gets interrupted by a signal and that signal is set to
> not restart the syscall its return code will get collected by the audit
> system before the registers are changed to the userspace valid EINTR;
> See the discussion in include/linux/errno.h

I have no idea if the fix is the "right way" of dealing with the problem (I'll 
let the audit experts vote on that), but thanks for looking into the problem 
and coming up with a possible solution.

-- 
paul moore
linux security @ hp