Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

audit: join tty records to their syscall

AUDIT_TTY records were logged as seperate events from their syscall
records. Join them so they are logged as the single event that they
are.

Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/106

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Richard Guy Briggs and committed by
Paul Moore
18f5c1d5 5f3d544f

+1 -1
+1 -1
drivers/tty/tty_audit.c
··· 66 66 uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current)); 67 67 unsigned int sessionid = audit_get_sessionid(current); 68 68 69 - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); 69 + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_TTY); 70 70 if (ab) { 71 71 char name[sizeof(current->comm)]; 72 72