]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
audit: ensure that 'audit=1' actually enables audit for PID 1
authorPaul Moore <paul@paul-moore.com>
Fri, 1 Sep 2017 13:44:34 +0000 (09:44 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 16 Dec 2017 09:32:31 +0000 (10:32 +0100)
commitdb23d45956bc30964a2e2c8f0d93753ca3106934
treeb5ca42c5ba8e1156f8595d1c1e1079b1610c4fa9
parentbf24f2225c69884d99be4909208fb6053c406971
audit: ensure that 'audit=1' actually enables audit for PID 1

[ Upstream commit 173743dd99a49c956b124a74c8aacb0384739a4c ]

Prior to this patch we enabled audit in audit_init(), which is too
late for PID 1 as the standard initcalls are run after the PID 1 task
is forked.  This means that we never allocate an audit_context (see
audit_alloc()) for PID 1 and therefore miss a lot of audit events
generated by PID 1.

This patch enables audit as early as possible to help ensure that when
PID 1 is forked it can allocate an audit_context if required.

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/audit.c