Commit 89670aff authored Dec 14, 2016 by Steve Grubb Committed by Paul Moore Dec 14, 2016

audit: Make AUDIT_ANOM_ABEND event normalized



The audit event specification asks for certain fields to exist in
all events. Running 'ausearch -m anom_abend -sv yes' returns no
events. This patch adds the result field so that the
AUDIT_ANOM_ABEND event conforms to the rules.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent 7c397d01

kernel/auditsc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2411,7 +2411,7 @@ void audit_core_dumps(long signr)
		if (unlikely(!ab))
		return;
		audit_log_task(ab);
		audit_log_format(ab, " sig=%ld", signr);
		audit_log_format(ab, " sig=%ld res=1", signr);
		audit_log_end(ab);
		}