On Thu, May 13, 2021 at 4:31 PM Casey Schaufler <[email protected]> wrote: > > Standalone audit records have the timestamp and serial number generated > on the fly and as such are unique, making them standalone. This new > function audit_alloc_local() generates a local audit context that will > be used only for a standalone record and its auxiliary record(s). The > context is discarded immediately after the local associated records are > produced. > > Signed-off-by: Richard Guy Briggs <[email protected]> > Signed-off-by: Casey Schaufler <[email protected]> > Cc: [email protected] > To: Richard Guy Briggs <[email protected]> > --- > include/linux/audit.h | 8 ++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- > 3 files changed, 37 insertions(+), 5 deletions(-)
At some point I suspect we will need to add filtering for these "local" records, but that is a problem for another day. Acked-by: Paul Moore <[email protected]> -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
