[PATCH 0/1] audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context

[Oleg Nesterov]

Even if I am right the problem is really minor, the patch should
be ignored without the authoritative acks.

I am only sending it because I am curious, and I would like to ask
another question about audit.


search_binary_handler()->audit_bprm(bprm) looks a bit strange, and
I can't understand if this is on purpose or not.

It adds the the AUDIT_EXECVE record every time the (recursive)
search_binary_handler() is called for audit_log_exit() which flushes
them all. But probably we only need a single record ?

And it seems that audit_aux_data_execve->envc is not used at all.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/