[PATCH 1/1 v1] Added exe field to audit core dump signal log
Paul Davies C
pauldaviesc at gmail.com
Thu Nov 21 02:18:51 UTC 2013
This patch addresses the issue of dissappearing exe field that was
raised by William in the previous discussion on this patch.
On Thursday 21 November 2013 07:43 AM, Paul Davies C wrote:
> Currently when the coredump signals are logged by the audit system , the
> actual path to the executable is not logged. Without details of exe , the
> system admin may not have an exact idea on what program failed.
>
> This patch changes the audit_log_task() so that the path to the exe is also
> logged.
>
> Signed-off-by: Paul Davies C <pauldaviesc at gmail.com>
> ---
> kernel/auditsc.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 9845cb3..4abae3d 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2353,6 +2353,7 @@ static void audit_log_task(struct audit_buffer *ab)
> kuid_t auid, uid;
> kgid_t gid;
> unsigned int sessionid;
> + struct mm_struct *mm = current->mm;
>
> auid = audit_get_loginuid(current);
> sessionid = audit_get_sessionid(current);
> @@ -2366,6 +2367,13 @@ static void audit_log_task(struct audit_buffer *ab)
> audit_log_task_context(ab);
> audit_log_format(ab, " pid=%d comm=", current->pid);
> audit_log_untrustedstring(ab, current->comm);
> + if (mm) {
> + down_read(&mm->mmap_sem);
> + if (mm->exe_file)
> + audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
> + up_read(&mm->mmap_sem);
> + } else
> + audit_log_format(ab, " exe=null");
> }
>
> static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
More information about the Linux-audit
mailing list