[PATCH] update audit rule change messages

Make the audit message for implicit rule removal more informative.
Make the rule update message consistent with other messages.

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

authored by Amy Griffis and committed by Al Viro 5974501e 8ef2d304

+14 -5
+14 -5
kernel/auditfilter.c
··· 914 914 } 915 915 916 916 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 917 - audit_log_format(ab, "audit updated rules specifying watch="); 917 + audit_log_format(ab, "audit updated rules specifying path="); 918 918 audit_log_untrustedstring(ab, owatch->path); 919 919 audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino); 920 920 audit_log_end(ab); ··· 937 937 struct audit_watch *w, *nextw; 938 938 struct audit_krule *r, *nextr; 939 939 struct audit_entry *e; 940 + struct audit_buffer *ab; 940 941 941 942 mutex_lock(&audit_filter_mutex); 942 943 parent->flags |= AUDIT_PARENT_INVALID; 943 944 list_for_each_entry_safe(w, nextw, &parent->watches, wlist) { 944 945 list_for_each_entry_safe(r, nextr, &w->rules, rlist) { 945 946 e = container_of(r, struct audit_entry, rule); 947 + 948 + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 949 + audit_log_format(ab, "audit implicitly removed rule path="); 950 + audit_log_untrustedstring(ab, w->path); 951 + if (r->filterkey) { 952 + audit_log_format(ab, " key="); 953 + audit_log_untrustedstring(ab, r->filterkey); 954 + } else 955 + audit_log_format(ab, " key=(null)"); 956 + audit_log_format(ab, " list=%d", r->listnr); 957 + audit_log_end(ab); 958 + 946 959 list_del(&r->rlist); 947 960 list_del_rcu(&e->list); 948 961 call_rcu(&e->rcu, audit_free_rule_rcu); 949 - 950 - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 951 - "audit implicitly removed rule from list=%d\n", 952 - AUDIT_FILTER_EXIT); 953 962 } 954 963 audit_remove_watch(w); 955 964 }