linux-audit / audit-kernel

GitHub mirror of the Linux Kernel's audit repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Other
138 stars 36 forks source link

BUG: connect AUDIT_LOGIN record to its syscall event #110

Closed rgbriggs closed 5 years ago

rgbriggs commented 5 years ago

Currently the AUDIT_LOGIN event is a standalone record that isn't connected to any other records that may be part of its syscall event. To avoid the confusion of generating two events, this record should be connected by using the audit_context() call rather than NULL.

pcmoore commented 5 years ago

We've treated similar issues as bugs haven't we? For example, look at the other issue you recently filed (#109) which considers a similar issue as a bug.

rgbriggs commented 5 years ago

On 2019-03-12 06:48, Paul Moore wrote:

We've treated similar issues as bugs haven't we? For example, look at the other issue you recently filed (#109) which considers a similar issue as a bug.

Yes, that's a very reasonable argument.

-- Richard Guy Briggs rgb@redhat.com Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635

rgbriggs commented 5 years ago

Posted v1: https://www.redhat.com/archives/linux-audit/2019-March/msg00080.html

rgbriggs commented 5 years ago

Staged in audit/next: 73e65b88feb9 audit: connect LOGIN record to its syscall record

rgbriggs commented 5 years ago

Upstreamed: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=02aff8db6438ce29371fd9cd54c57213f4bb4536