audit: tie ANOM_ABEND records to syscall

Browse source

Since core dump events are triggered by user activity, tie the
ANOM_ABEND record to the syscall record to collect all records from the
same event.

See: https://github.com/linux-audit/audit-kernel/issues/88

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Richard Guy Briggs 2018-05-31 16:28:12 -04:00 • committed by Paul Moore

parent 9b8753fffe

commit d87de4a878

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

kernel/auditsc.c

View file