|
 |
61865e |
diff -urp audit-2.6.5.orig/src/auditd-config.c audit-2.6.5/src/auditd-config.c
|
|
|
61865e |
--- audit-2.6.5.orig/src/auditd-config.c 2016-07-14 15:53:39.000000000 +0000
|
|
|
61865e |
+++ audit-2.6.5/src/auditd-config.c 2017-01-20 15:59:31.719704789 +0000
|
|
|
61865e |
@@ -841,8 +841,7 @@ static int log_format_parser(struct nv_p
|
|
|
61865e |
if (config->log_format == LF_NOLOG) {
|
|
|
61865e |
audit_msg(LOG_WARNING,
|
|
|
61865e |
"The NOLOG option to log_format is deprecated. Please use the write_logs option.");
|
|
|
61865e |
- if (config->log_format == LF_NOLOG &&
|
|
|
61865e |
- config->write_logs != 0)
|
|
|
61865e |
+ if (config->write_logs != 0)
|
|
|
61865e |
audit_msg(LOG_WARNING,
|
|
|
61865e |
"The NOLOG option is overriding the write_logs current setting.");
|
|
|
61865e |
config->write_logs = 0;
|
|
|
61865e |
diff -urp audit-2.6.5.orig/src/auditd-event.c audit-2.6.5/src/auditd-event.c
|
|
|
61865e |
--- audit-2.6.5.orig/src/auditd-event.c 2017-01-20 15:54:57.969419865 +0000
|
|
|
61865e |
+++ audit-2.6.5/src/auditd-event.c 2017-01-20 16:04:17.562133973 +0000
|
|
|
61865e |
@@ -48,6 +48,8 @@
|
|
|
61865e |
extern volatile int stop;
|
|
|
61865e |
|
|
|
61865e |
/* Local function prototypes */
|
|
|
61865e |
+static void send_ack(const struct auditd_event *e, int ack_type,
|
|
|
61865e |
+ const char *msg);
|
|
|
61865e |
static void write_to_log(const struct auditd_event *e);
|
|
|
61865e |
static void check_log_file_size(void);
|
|
|
61865e |
static void check_space_left(void);
|
|
|
61865e |
@@ -496,7 +498,7 @@ void handle_event(struct auditd_event *e
|
|
|
61865e |
if (config->write_logs == 0)
|
|
|
61865e |
return;
|
|
|
61865e |
}
|
|
|
61865e |
- if (!logging_suspended) {
|
|
|
61865e |
+ if (!logging_suspended && config->write_logs) {
|
|
|
61865e |
write_to_log(e);
|
|
|
61865e |
|
|
|
61865e |
/* See if we need to flush to disk manually */
|
|
|
61865e |
@@ -537,7 +539,10 @@ void handle_event(struct auditd_event *e
|
|
|
61865e |
}
|
|
|
61865e |
}
|
|
|
61865e |
}
|
|
|
61865e |
- }
|
|
|
61865e |
+ } else if (!config->write_logs)
|
|
|
61865e |
+ send_ack(e, AUDIT_RMW_TYPE_ACK, "");
|
|
|
61865e |
+ // FIXME: When logging is suspended, what should remote do?
|
|
|
61865e |
+ // Should probably be new response type
|
|
|
61865e |
}
|
|
|
61865e |
|
|
|
61865e |
static void send_ack(const struct auditd_event *e, int ack_type,
|