From: Steve Grubb <sgrubb@redhat.com>
Date: Wed, 14 Dec 2016 21:00:13 +0000 (-0500)
Subject: audit: Make AUDIT_ANOM_ABEND event normalized
X-Git-Tag: v4.11-rc1~137^2~4
X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=89670affa2a62c4868a2dd8a4195a1a2ec58cb27;p=linux.git

audit: Make AUDIT_ANOM_ABEND event normalized

The audit event specification asks for certain fields to exist in
all events. Running 'ausearch -m anom_abend -sv yes' returns no
events. This patch adds the result field so that the
AUDIT_ANOM_ABEND event conforms to the rules.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index f78cb1b3fa74..bb5f504592c6 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2411,7 +2411,7 @@ void audit_core_dumps(long signr)
 	if (unlikely(!ab))
 		return;
 	audit_log_task(ab);
-	audit_log_format(ab, " sig=%ld", signr);
+	audit_log_format(ab, " sig=%ld res=1", signr);
 	audit_log_end(ab);
 }