Skip to content

Commit

Permalink
[AUDIT] include audit type in audit message when using printk
Browse files Browse the repository at this point in the history
Currently audit drops the audit type when an audit message goes through
printk instead of the audit deamon.  This is a minor annoyance in
that the audit type is no longer part of the message and the information
the audit type conveys needs to be carried in, or derived from the
message data.

The attached patch includes the type number as part of the printk.
Admittedly it isn't the type name that the audit deamon provides but I
think this is better than dropping the type completely.

Signed-pff-by: John Johansen <jjohansen@suse.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
  • Loading branch information
Eric Paris authored and Al Viro committed Feb 1, 2008
1 parent 6246cca commit e445deb
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion kernel/audit.c
Original file line number Diff line number Diff line change
Expand Up @@ -1438,7 +1438,8 @@ void audit_log_end(struct audit_buffer *ab)
ab->skb = NULL;
wake_up_interruptible(&kauditd_wait);
} else {
printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
}
}
audit_buffer_free(ab);
Expand Down

0 comments on commit e445deb

Please sign in to comment.