audit: tie SECCOMP records to syscall
authorRichard Guy Briggs <rgb@redhat.com>
Thu, 31 May 2018 20:27:24 +0000 (16:27 -0400)
committerPaul Moore <paul@paul-moore.com>
Tue, 19 Jun 2018 14:26:59 +0000 (10:26 -0400)
commit9b8753fffe7b3642688135f28aa8a0a0f45fd9ab
treeebe063c87aa4c838d4aead0e2fedb600ab8515ee
parent29c1372d6a9b872acf479ba2744e4e7f043981c0
audit: tie SECCOMP records to syscall

Since seccomp events are triggered by user activity, tie the SECCOMP
record to the syscall record to collect all records from the same event.

See: https://github.com/linux-audit/audit-kernel/issues/87

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/auditsc.c