Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] drop EOE records from printk

Browse source 
Hi,

While we are looking at the printk issue, I see that its printk'ing the EOE
(end of event) records which is really not something that we need in syslog.
Its really intended for the realtime audit event stream handled by the audit
daemon. So, lets avoid printk'ing that record type.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Steve Grubb 2008-02-21 16:59:22 -05:00 committed by Al Viro
parent b29ee87e9b
commit 8d07a67cfa
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
kernel/audit.c
View file

@ -1353,17 +1353,19 @@ void audit_log_end(struct audit_buffer *ab)
if (!audit_rate_check()) {
audit_log_lost("rate limit exceeded");
} else {
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
if (audit_pid) {
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
skb_queue_tail(&audit_skb_queue, ab->skb);
ab->skb = NULL;
wake_up_interruptible(&kauditd_wait);
} else if (printk_ratelimit()) {
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
} else {
audit_log_lost("printk limit exceeded\n");
} else if (nlh->nlmsg_type != AUDIT_EOE) {
if (printk_ratelimit()) {
printk(KERN_NOTICE "type=%d %s\n",
nlh->nlmsg_type,
ab->skb->data + NLMSG_SPACE(0));
} else
audit_log_lost("printk limit exceeded\n");
}
}
audit_buffer_free(ab);