From: Richard Guy Briggs Date: Tue, 19 Mar 2019 19:23:29 +0000 (-0400) Subject: audit: connect LOGIN record to its syscall record X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=73e65b88feb919f95bdb77c4ed35f69588cf27ee;p=linux.git audit: connect LOGIN record to its syscall record Currently the AUDIT_LOGIN event is a standalone record that isn't connected to any other records that may be part of its syscall event. To avoid the confusion of generating two events, connect the records by using its syscall context. Please see the github issue https://github.com/linux-audit/audit-kernel/issues/110 Signed-off-by: Richard Guy Briggs Signed-off-by: Paul Moore --- diff --git a/kernel/audit.c b/kernel/audit.c index c89ea48c70a6e..b96bf69183f4d 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2220,7 +2220,7 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid, if (!audit_enabled) return; - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_LOGIN); if (!ab) return;