Re: Getting the real task name in avc messages

[Darrel Goeddel <dgoeddel@xxxxxxxxxxxxx>]

James Morris wrote:
> On Wed, 30 Mar 2005, James Morris wrote:
>
>
> > This will be looked upon dimly upstream:
> >
> > +        char name[sizeof(current->comm)];
> >
> > the kernel stack space is very limited.
>
>
> Actually, current->comm is only defined by default to be 16 bytes, so it's 
> ok.
>
>
> - James

You could also just do:

	task_lock(current);
	audit_log_format(ab, " comm=%s", current->comm);
	task_unlock(current);

This avoids an unnecessary copy since we have no use the data after the
audit_log_format call.

I really like the idea of moving this functionality to the standard
syscall audit record.  I'm sure that this would be nice info to have
for folks who do not run SELinux.

--

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.