Since only one of val, uid and gid are used at any given time, combine them to reduce the size of the struct audit_field.
Signed-off-by: Richard Guy Briggs <r...@redhat.com> --- include/linux/audit.h | 8 +++++--- kernel/auditfilter.c | 2 -- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 1ae0089..06141b3 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -66,9 +66,11 @@ struct audit_krule { struct audit_field { u32 type; - u32 val; - kuid_t uid; - kgid_t gid; + union { + u32 val; + kuid_t uid; + kgid_t gid; + }; u32 op; char *lsm_str; void *lsm_rule; diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index b65a138..ea8d389 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -422,8 +422,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, f->type = data->fields[i]; f->val = data->values[i]; - f->uid = INVALID_UID; - f->gid = INVALID_GID; f->lsm_str = NULL; f->lsm_rule = NULL; -- 1.7.1 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit