• Jason Baron's avatar
    [PATCH] make vm86 call audit_syscall_exit · f38f300d
    Jason Baron authored
    hi,
    
    The motivation behind the patch below was to address messages in
    /var/log/messages such as:
    
    Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing
    multiple contexts (1)
    Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing
    multiple contexts (2)
    
    I can reproduce by running 'get-edid' from:
    http://john.fremlin.de/programs/linux/read-edid/.
    
    These messages come about in the log b/c the vm86 calls do not exit via
    the normal system call exit paths and thus do not call
    'audit_syscall_exit'. The next system call will then free the context for
    itself and for the vm86 context, thus generating the above messages. This
    patch addresses the issue by simply adding a call to 'audit_syscall_exit'
    from the vm86 code.
    
    Besides fixing the above error messages the patch also now allows vm86
    system calls to become auditable. This is useful since strace does not
    appear to properly record the return values from sys_vm86.
    
    I think this patch is al...
    f38f300d
auditsc.c 33.3 KB