audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context
authorOleg Nesterov <oleg@redhat.com>
Sun, 15 Sep 2013 17:11:09 +0000 (19:11 +0200)
committerEric Paris <eparis@redhat.com>
Tue, 5 Nov 2013 16:07:18 +0000 (11:07 -0500)
commitd48d805122e39c066898df2e460875d3aaf60508
tree01142204314c7e0d938dba19b9c07c27bf97a277
parentaf0e493d304262162dcc0e0b39ee47b12461d003
audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context

If audit_filter_task() nacks the new thread it makes sense
to clear TIF_SYSCALL_AUDIT which can be copied from parent
by dup_task_struct().

A wrong TIF_SYSCALL_AUDIT is not really bad but it triggers
the "slow" audit paths in entry.S to ensure the task can not
miss audit_syscall_*() calls, this is pointless if the task
has no ->audit_context.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Steve Grubb <sgrubb@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
kernel/auditsc.c