[PATCH V2 ghak120] audit: trigger accompanying records when no rules present

[Richard Guy Briggs]

On 2020-03-12 10:51, Paul Moore wrote:
> On Tue, Mar 10, 2020 at 9:21 AM Richard Guy Briggs <rgb at redhat.com> wrote:
> >
> > When there are no audit rules registered, mandatory records (config,
> > etc.) are missing their accompanying records (syscall, proctitle, etc.).
> >
> > This is due to audit context dummy set on syscall entry based on absence
> > of rules that signals that no other records are to be printed.
> >
> > Clear the dummy bit if any record is generated.
> >
> > The proctitle context and dummy checks are pointless since the
> > proctitle record will not be printed if no syscall records are printed.
> >
> > Please see upstream github issue
> > https://github.com/linux-audit/audit-kernel/issues/120
> >
> > Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> > ---
> > Chagelog:
> > v2:
> > - unconditionally clear dummy
> > - create audit_clear_dummy accessor function
> > - remove proctitle context and dummy checks
> > ---
> >  kernel/audit.c   | 1 +
> >  kernel/audit.h   | 8 ++++++++
> >  kernel/auditsc.c | 3 ---
> >  3 files changed, 9 insertions(+), 3 deletions(-)
> 
> Merged into audit/next, thanks.

Danke!

> paul moore

- RGB

--
Richard Guy Briggs <rgb at redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635