On Tue, Mar 19, 2019 at 3:24 PM Richard Guy Briggs <r...@redhat.com> wrote: > Currently the AUDIT_LOGIN event is a standalone record that isn't > connected to any other records that may be part of its syscall event. To > avoid the confusion of generating two events, connect the records by > using its syscall context. > > Please see the github issue > https://github.com/linux-audit/audit-kernel/issues/110 > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > --- > Passes audit-testsuite and ausearch-test-0.6 > > kernel/audit.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-)
Merged into audit/next, thanks. -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
