From: Steve Grubb Date: Wed, 14 Dec 2016 20:59:46 +0000 (-0500) Subject: audit: Make AUDIT_KERNEL event conform to the specification X-Git-Tag: v4.11-rc1~137^2~5 X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=7c397d01e43493dd087f9cd926cd1fcf508a8019;p=linux.git audit: Make AUDIT_KERNEL event conform to the specification The AUDIT_KERNEL event is not following name=value format. This causes some information to get lost. The event has been reformatted to follow the convention. Additionally the audit_enabled value was added for troubleshooting purposes. The following is an example of the new event: type=KERNEL audit(1480621249.833:1): state=initialized audit_enabled=0 res=1 Signed-off-by: Steve Grubb [PM: commit tweaks to make checkpatch.pl happy] Signed-off-by: Paul Moore --- diff --git a/kernel/audit.c b/kernel/audit.c index 41017685f9f2..57acf2541fdd 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1344,7 +1344,9 @@ static int __init audit_init(void) panic("audit: failed to start the kauditd thread (%d)\n", err); } - audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); + audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, + "state=initialized audit_enabled=%u res=1", + audit_enabled); return 0; }