AUDIT: No really, we don't want to audit auditd.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
This commit is contained in:
@@ -573,7 +573,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
|
|||||||
context->return_valid = return_valid;
|
context->return_valid = return_valid;
|
||||||
context->return_code = return_code;
|
context->return_code = return_code;
|
||||||
|
|
||||||
if (context->in_syscall && !context->auditable) {
|
if (context->in_syscall && !context->auditable && tsk->pid != audit_pid) {
|
||||||
enum audit_state state;
|
enum audit_state state;
|
||||||
state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
|
state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
|
||||||
if (state == AUDIT_RECORD_CONTEXT)
|
if (state == AUDIT_RECORD_CONTEXT)
|
||||||
|
Reference in New Issue
Block a user