audit: connect LOGIN record to its syscall record
authorRichard Guy Briggs <rgb@redhat.com>
Tue, 19 Mar 2019 19:23:29 +0000 (15:23 -0400)
committerPaul Moore <paul@paul-moore.com>
Thu, 21 Mar 2019 00:57:48 +0000 (20:57 -0400)
commit73e65b88feb919f95bdb77c4ed35f69588cf27ee
tree07145ed7696af7225b4e4cb074e5267ef0df27ca
parent95e0b46fcebd7dbf6850dee96046e4c4ddc7f69c
audit: connect LOGIN record to its syscall record

Currently the AUDIT_LOGIN event is a standalone record that isn't
connected to any other records that may be part of its syscall event. To
avoid the confusion of generating two events, connect the records by
using its syscall context.

Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/110

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit.c