path: root/kernel/audit.h
diff options
authorRichard Guy Briggs <>2013-10-30 18:05:24 -0400
committerEric Paris <>2013-11-05 11:15:03 -0500
commit9410d228a4cf434305306746bb799fb7acdd8648 (patch)
tree93dc6f756af3c2557f2e1377bad52582fdd9fe19 /kernel/audit.h
parentd9cfea91e97d5d19f9d69beaa844f5fe56a6adc6 (diff)
audit: call audit_bprm() only once to add AUDIT_EXECVE information
Move the audit_bprm() call from search_binary_handler() to exec_binprm(). This allows us to get rid of the mm member of struct audit_aux_data_execve since bprm->mm will equal current->mm. This also mitigates the issue that ->argc could be modified by the load_binary() call in search_binary_handler(). audit_bprm() was being called to add an AUDIT_EXECVE record to the audit context every time search_binary_handler() was recursively called. Only one reference is necessary. Reported-by: Oleg Nesterov <> Cc: Eric Paris <> Signed-off-by: Richard Guy Briggs <> Signed-off-by: Eric Paris <> --- This patch is against 3.11, but was developed on Oleg's post-3.11 patches that introduce exec_binprm().
Diffstat (limited to 'kernel/audit.h')
1 files changed, 0 insertions, 1 deletions
diff --git a/kernel/audit.h b/kernel/audit.h
index e7b94ab66c49..b779642b29af 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -199,7 +199,6 @@ struct audit_context {
} mmap;
struct {
int argc;
- struct mm_struct *mm;
} execve;
int fds[2];