[PATCH] audit: use union for audit_field values since they are mutually exclusive

Richard Guy Briggs rgb at redhat.com
Mon Jun 16 19:57:10 UTC 2014


Since only one of val, uid and gid are used at any given time, combine them to
reduce the size of the struct audit_field.

Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
---
 include/linux/audit.h |    8 +++++---
 kernel/auditfilter.c  |    2 --
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 1ae0089..06141b3 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -66,9 +66,11 @@ struct audit_krule {
 
 struct audit_field {
 	u32				type;
-	u32				val;
-	kuid_t				uid;
-	kgid_t				gid;
+	union {
+		u32			val;
+		kuid_t			uid;
+		kgid_t			gid;
+	};
 	u32				op;
 	char				*lsm_str;
 	void				*lsm_rule;
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index b65a138..ea8d389 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -422,8 +422,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 
 		f->type = data->fields[i];
 		f->val = data->values[i];
-		f->uid = INVALID_UID;
-		f->gid = INVALID_GID;
 		f->lsm_str = NULL;
 		f->lsm_rule = NULL;
 
-- 
1.7.1




More information about the Linux-audit mailing list