On Thu, May 13, 2021 at 4:31 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > > Standalone audit records have the timestamp and serial number generated > on the fly and as such are unique, making them standalone. This new > function audit_alloc_local() generates a local audit context that will > be used only for a standalone record and its auxiliary record(s). The > context is discarded immediately after the local associated records are > produced. > > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx> > Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> > Cc: linux-audit@xxxxxxxxxx > To: Richard Guy Briggs <rgb@xxxxxxxxxx> > --- > include/linux/audit.h | 8 ++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- > 3 files changed, 37 insertions(+), 5 deletions(-) At some point I suspect we will need to add filtering for these "local" records, but that is a problem for another day. Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> -- paul moore www.paul-moore.com
