Skip to content
Commit b24a30a7 authored by Eric Paris's avatar Eric Paris
Browse files

audit: fix event coverage of AUDIT_ANOM_LINK



The userspace audit tools didn't like the existing formatting of the
AUDIT_ANOM_LINK event. It needed to be expanded to emit an AUDIT_PATH
event as well, so this implements the change. The bulk of the patch is
moving code out of auditsc.c into audit.c and audit.h for general use.
It expands audit_log_name to include an optional "struct path" argument
for the simple case of just needing to report a pathname. This also
makes
audit_log_task_info available when syscall auditing is not enabled,
since
it is needed in either case for process details.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reported-by: default avatarSteve Grubb <sgrubb@redhat.com>
parent 7173c54e
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment