Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21af6c4f authored by David Woodhouse's avatar David Woodhouse
Browse files

AUDIT: Really don't audit auditd. 



The pid in the audit context isn't always set up. Use tsk->pid when 
checking whether it's auditd in audit_filter_syscall(), instead of 
ctx->pid. Remove a band-aid which did the same elsewhere.

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent ac4cec44

kernel/auditsc.c

+2 −2
Original line number Diff line number Diff line
@@ -516,7 +516,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, 
	int		   word = AUDIT_WORD(ctx->major);

	int		   bit  = AUDIT_BIT(ctx->major);



	if (audit_pid && ctx->pid == audit_pid)

	if (audit_pid && tsk->pid == audit_pid)

		return AUDIT_DISABLED;



	rcu_read_lock();
@@ -601,7 +601,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk, 
	context->return_valid = return_valid;

	context->return_code  = return_code;



	if (context->in_syscall && !context->auditable && tsk->pid != audit_pid) {

	if (context->in_syscall && !context->auditable) {

		enum audit_state state;

		state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);

		if (state == AUDIT_RECORD_CONTEXT)