AUDIT: Unify auid reporting, put arch before syscall number
These changes make processing of audit logs easier. Based on a patch
from Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
diff --git a/kernel/audit.c b/kernel/audit.c
index 35306f4..ef35166 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -234,7 +234,7 @@
int old = audit_rate_limit;
audit_rate_limit = limit;
audit_log(NULL, AUDIT_CONFIG_CHANGE,
- "audit_rate_limit=%d old=%d by auid %u",
+ "audit_rate_limit=%d old=%d by auid=%u",
audit_rate_limit, old, loginuid);
return old;
}
@@ -244,7 +244,7 @@
int old = audit_backlog_limit;
audit_backlog_limit = limit;
audit_log(NULL, AUDIT_CONFIG_CHANGE,
- "audit_backlog_limit=%d old=%d by auid %u",
+ "audit_backlog_limit=%d old=%d by auid=%u",
audit_backlog_limit, old, loginuid);
return old;
}
@@ -256,7 +256,7 @@
return -EINVAL;
audit_enabled = state;
audit_log(NULL, AUDIT_CONFIG_CHANGE,
- "audit_enabled=%d old=%d by auid %u",
+ "audit_enabled=%d old=%d by auid=%u",
audit_enabled, old, loginuid);
return old;
}
@@ -270,7 +270,7 @@
return -EINVAL;
audit_failure = state;
audit_log(NULL, AUDIT_CONFIG_CHANGE,
- "audit_failure=%d old=%d by auid %u",
+ "audit_failure=%d old=%d by auid=%u",
audit_failure, old, loginuid);
return old;
}
@@ -424,7 +424,7 @@
int old = audit_pid;
audit_pid = status_get->pid;
audit_log(NULL, AUDIT_CONFIG_CHANGE,
- "audit_pid=%d old=%d by auid %u",
+ "audit_pid=%d old=%d by auid=%u",
audit_pid, old, loginuid);
}
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)