From e404e103ee52f4ba88ad52ce82d3b397a15f7124 Mon Sep 17 00:00:00 2001
From: Eric Paris <eparis@redhat.com>
Date: Tue, 8 Jan 2008 17:38:31 -0500
Subject: [PATCH] --- yaml --- r: 82035 b: refs/heads/master c:
 b593d384efcff7bdf6beb1bc1bc69927977aee26 h: refs/heads/master i:   82033:
 9ef77e4aa4ef070110974bfa07e45032208f2fb0   82031:
 059e66c7da535cfb6163b981e6a962a0fd9ea3f1 v: v3

---
 [refs]                 |  2 +-
 trunk/kernel/audit.c   | 16 +++++++++++++---
 trunk/kernel/auditsc.c |  3 ++-
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index 9b0d660f7874..2ced115afef7 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 50397bd1e471391d27f64efad9271459c913de87
+refs/heads/master: b593d384efcff7bdf6beb1bc1bc69927977aee26
diff --git a/trunk/kernel/audit.c b/trunk/kernel/audit.c
index 549b2f55b649..1242021c7a6d 100644
--- a/trunk/kernel/audit.c
+++ b/trunk/kernel/audit.c
@@ -70,6 +70,7 @@ static int	audit_initialized;
 #define AUDIT_ON	1
 #define AUDIT_LOCKED	2
 int		audit_enabled;
+int		audit_ever_enabled;
 
 /* Default state when kernel boots without any parameters. */
 static int	audit_default;
@@ -310,11 +311,17 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
 
 static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
 {
+	int rc;
 	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
 		return -EINVAL;
 
-	return audit_do_config_change("audit_enabled", &audit_enabled, state,
-				      loginuid, sid);
+	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state,
+				     loginuid, sid);
+
+	if (!rc)
+		audit_ever_enabled |= !!state;
+
+	return rc;
 }
 
 static int audit_set_failure(int state, uid_t loginuid, u32 sid)
@@ -857,6 +864,7 @@ static int __init audit_init(void)
 	skb_queue_head_init(&audit_skb_queue);
 	audit_initialized = 1;
 	audit_enabled = audit_default;
+	audit_ever_enabled |= !!audit_default;
 
 	/* Register the callback with selinux.  This callback will be invoked
 	 * when a new policy is loaded. */
@@ -884,8 +892,10 @@ static int __init audit_enable(char *str)
 	printk(KERN_INFO "audit: %s%s\n",
 	       audit_default ? "enabled" : "disabled",
 	       audit_initialized ? "" : " (after initialization)");
-	if (audit_initialized)
+	if (audit_initialized) {
 		audit_enabled = audit_default;
+		audit_ever_enabled |= !!audit_default;
+	}
 	return 1;
 }
 
diff --git a/trunk/kernel/auditsc.c b/trunk/kernel/auditsc.c
index 6e03322e155b..1c06ecf38d7b 100644
--- a/trunk/kernel/auditsc.c
+++ b/trunk/kernel/auditsc.c
@@ -70,6 +70,7 @@
 #include "audit.h"
 
 extern struct list_head audit_filter_list[];
+extern int audit_ever_enabled;
 
 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
  * for saving names from getname(). */
@@ -838,7 +839,7 @@ int audit_alloc(struct task_struct *tsk)
 	struct audit_context *context;
 	enum audit_state     state;
 
-	if (likely(!audit_enabled))
+	if (likely(!audit_ever_enabled))
 		return 0; /* Return if not auditing. */
 
 	state = audit_filter_task(tsk);