OSDN Git Service

audit: ensure that 'audit=1' actually enables audit for PID 1
authorPaul Moore <paul@paul-moore.com>
Fri, 1 Sep 2017 13:44:34 +0000 (09:44 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 16 Dec 2017 15:25:47 +0000 (16:25 +0100)
commit93dedcf5a17779c73a7609b9306b519555b9edb8
tree962188a7b2809958f42375a6fd49f189a2c4088e
parenta625a16c8aea00aeff6dd95aebe384bf309b261a
audit: ensure that 'audit=1' actually enables audit for PID 1

[ Upstream commit 173743dd99a49c956b124a74c8aacb0384739a4c ]

Prior to this patch we enabled audit in audit_init(), which is too
late for PID 1 as the standard initcalls are run after the PID 1 task
is forked.  This means that we never allocate an audit_context (see
audit_alloc()) for PID 1 and therefore miss a lot of audit events
generated by PID 1.

This patch enables audit as early as possible to help ensure that when
PID 1 is forked it can allocate an audit_context if required.

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/audit.c