Skip to content
  • Jeff Layton's avatar
    audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record · 24dccf86
    Jeff Layton authored
    commit 79f6530cb59e2a0af6953742a33cc29e98ca631c upstream.
    
    The old audit PATH records for mq_open looked like this:
    
      type=PATH msg=audit(1366282323.982:869): item=1 name=(null) inode=6777
      dev=00:0c mode=041777 ouid=0 ogid=0 rdev=00:00
      obj=system_u:object_r:tmpfs_t:s15:c0.c1023
      type=PATH msg=audit(1366282323.982:869): item=0 name="test_mq" inode=26732
      dev=00:0c mode=0100700 ouid=0 ogid=0 rdev=00:00
      obj=staff_u:object_r:user_tmpfs_t:s15:c0.c1023
    
    ...with the audit related changes that went into 3.7, they now look like this:
    
      type=PATH msg=audit(1366282236.776:3606): item=2 name=(null) inode=66655
      dev=00:0c mode=0100700 ouid=0 ogid=0 rdev=00:00
      obj=staff_u:object_r:user_tmpfs_t:s15:c0.c1023
      type=PATH msg=audit(1366282236.776:3606): item=1 name=(null) inode=6926
      dev=00:0c mode=041777 ouid=0 ogid=0 rdev=00:00
      obj=system_u:object_r:tmpfs_t:s15:c0.c1023
      type=PATH msg=audit(1366282236.776:3606): ite...
    24dccf86