• Ondrej Mosnacek's avatar
    lsm_audit: avoid overloading the "key" audit field · 8e71168e
    Ondrej Mosnacek authored
    The "key" field is used to associate records with the rule that
    triggered them, os it's not a good idea to overload it with an
    additional IPC key semantic. Moreover, as the classic "key" field is a
    text field, while the IPC key is numeric, AVC records containing the IPC
    key info actually confuse audit userspace, which tries to interpret the
    number as a hex-encoded string, thus showing garbage for example in the
    ausearch "interpret" output mode.
    
    Hence, change it to "ipc_key" to fix both issues and also make the
    meaning of this field more clear.
    Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
    Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    8e71168e
lsm_audit.c 10.9 KB