Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d07a67c authored by Steve Grubb's avatar Steve Grubb Committed by Al Viro
Browse files

[PATCH] drop EOE records from printk 



Hi,

While we are looking at the printk issue, I see that its printk'ing the EOE
(end of event) records which is really not something that we need in syslog.
Its really intended for the realtime audit event stream handled by the audit
daemon. So, lets avoid printk'ing that record type.

Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent b29ee87e

kernel/audit.c

+8 −6
Original line number Diff line number Diff line
@@ -1353,16 +1353,18 @@ void audit_log_end(struct audit_buffer *ab) 
	if (!audit_rate_check()) {

		audit_log_lost("rate limit exceeded");

	} else {

		if (audit_pid) {

		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);

		if (audit_pid) {

			nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);

			skb_queue_tail(&audit_skb_queue, ab->skb);

			ab->skb = NULL;

			wake_up_interruptible(&kauditd_wait);

		} else if (printk_ratelimit()) {

			struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);

			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));

		} else {

		} else if (nlh->nlmsg_type != AUDIT_EOE) {

			if (printk_ratelimit()) {

				printk(KERN_NOTICE "type=%d %s\n",

					nlh->nlmsg_type,

					ab->skb->data + NLMSG_SPACE(0));

			} else

				audit_log_lost("printk limit exceeded\n");

		}

	}