audit: implement audit by executable

[linux-2.6-block.git] / kernel / audit_tree.c

diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 2e0c97427b339c2f794568b8bb0ac383abf90421..f417225068089c23f55a3ca9ab9024e9b3166b8e 100644 (file)
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -478,6 +478,8 @@ static void kill_rules(struct audit_tree *tree)
                if (rule->tree) {
                        /* not a half-baked one */
                        audit_tree_log_remove_rule(rule);
+                       if (entry->rule.exe)
+                               audit_remove_mark(entry->rule.exe);
                        rule->tree = NULL;
                        list_del_rcu(&entry->list);
                        list_del(&entry->rule.list);