]> git.karo-electronics.de Git - karo-tx-linux.git/commitdiff
audit: Make AUDIT_KERNEL event conform to the specification
authorSteve Grubb <sgrubb@redhat.com>
Wed, 14 Dec 2016 20:59:46 +0000 (15:59 -0500)
committerPaul Moore <paul@paul-moore.com>
Wed, 14 Dec 2016 20:59:46 +0000 (15:59 -0500)
The AUDIT_KERNEL event is not following name=value format. This causes
some information to get lost. The event has been reformatted to follow
the convention. Additionally the audit_enabled value was added for
troubleshooting purposes. The following is an example of the new event:

  type=KERNEL audit(1480621249.833:1): state=initialized
              audit_enabled=0 res=1

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
[PM: commit tweaks to make checkpatch.pl happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit.c

index 41017685f9f2836754d2338dfd75882d4f9be49a..57acf2541fdda40b8443a5ed54fccf7600e86c12 100644 (file)
@@ -1344,7 +1344,9 @@ static int __init audit_init(void)
                panic("audit: failed to start the kauditd thread (%d)\n", err);
        }
 
-       audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+       audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
+               "state=initialized audit_enabled=%u res=1",
+                audit_enabled);
 
        return 0;
 }