From: Richard Guy Briggs Date: Tue, 5 Feb 2019 22:19:06 +0000 (-0500) Subject: audit: join tty records to their syscall X-Git-Tag: v5.1-rc1~130^2~2 X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=18f5c1d567a5d16aa6ebac6a2f42e51fc5030baa;p=linux.git audit: join tty records to their syscall AUDIT_TTY records were logged as seperate events from their syscall records. Join them so they are logged as the single event that they are. Please see the github issue https://github.com/linux-audit/audit-kernel/issues/106 Signed-off-by: Richard Guy Briggs Signed-off-by: Paul Moore --- diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c index 28f87fd6a28e..9f906a5b8e81 100644 --- a/drivers/tty/tty_audit.c +++ b/drivers/tty/tty_audit.c @@ -66,7 +66,7 @@ static void tty_audit_log(const char *description, dev_t dev, uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current)); unsigned int sessionid = audit_get_sessionid(current); - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_TTY); if (ab) { char name[sizeof(current->comm)];