audit: log the audit_names record type
authorJeff Layton <jlayton@redhat.com>
Wed, 8 May 2013 14:32:23 +0000 (10:32 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Dec 2013 19:05:39 +0000 (11:05 -0800)
commit50c7c5188d298a63b773713e76ceef787bfbb04f
tree88f786002ffda2d80feed2617fb567a4f168404a
parent5709767a1d99cb3c2993fd5ac8c431870971095b
audit: log the audit_names record type

commit d3aea84a4ace5ff9ce7fb7714cee07bebef681c2 upstream.

...to make it clear what the intent behind each record's operation was.

In many cases you can infer this, based on the context of the syscall
and the result. In other cases it's not so obvious. For instance, in
the case where you have a file being renamed over another, you'll have
two different records with the same filename but different inode info.
By logging this information we can clearly tell which one was created
and which was deleted.

This fixes what was broken in commit bfcec708.
Commit 79f6530c should also be backported to stable v3.7+.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/audit.c