audit: tie SECCOMP records to syscall

Browse source

Since seccomp events are triggered by user activity, tie the SECCOMP
record to the syscall record to collect all records from the same event.

See: https://github.com/linux-audit/audit-kernel/issues/87

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Richard Guy Briggs 2018-05-31 16:27:24 -04:00 • committed by Paul Moore

parent 29c1372d6a

commit 9b8753fffe

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

kernel/auditsc.c

View file