audit: log failed attempts to change audit_pid configuration
authorRichard Guy Briggs <rgb@redhat.com>
Mon, 25 Jan 2016 23:04:15 +0000 (18:04 -0500)
committerPaul Moore <paul@paul-moore.com>
Mon, 25 Jan 2016 23:04:15 +0000 (18:04 -0500)
commit935c9e7ff06abf12c45155f75ec2f712d3768095
treeac1118ff77239fe8f939c9bfd2afe37cc5c4fa19
parent133e1e5acd4a63c4a0dcc413e90d5decdbce9c4a
audit: log failed attempts to change audit_pid configuration

Failed attempts to change the audit_pid configuration are not presently
logged.  One case is an attempt to starve an old auditd by starting up
a new auditd when the old one is still alive and active.  The other
case is an attempt to orphan a new auditd when an old auditd shuts
down.

Log both as AUDIT_CONFIG_CHANGE messages with failure result.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
kernel/audit.c