[RFC] audit: allow audit_reusename to check kernel path

Paul Moore paul at paul-moore.com
Tue May 26 12:32:06 UTC 2020


On Mon, May 25, 2020 at 3:22 AM Yiwen Gu <guyiwen at huawei.com> wrote:
> For now, we met a situation where the audit_reusename checking
> function returns the same filename structure for files sharing
> the same uptr. However, these files are different, and we are trying
> to open them in a loop where the names are loaded into the same address.
> Therefore, the function returns the same structure for different files.
> By the way, may I ask in what situation would the audit_list be kept
> across syscalls?

What kernel are you using?  Is this an Android kernel?

Do you have a reproducer you can share?

-- 
paul moore
www.paul-moore.com




More information about the Linux-audit mailing list