audit: ensure that 'audit=1' actually enables audit for PID 1
authorPaul Moore <paul@paul-moore.com>
Fri, 1 Sep 2017 13:44:34 +0000 (09:44 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 17 Dec 2017 14:08:00 +0000 (15:08 +0100)
commit0ad0bb60166d8e4fbacaaaaaeb10a24de5e99aff
tree4f71d8cd05b6fb9f5e34134944eeeb1e6b367b21
parent4086f7cf0c3e2fe275a2a18dc25749df348c0cdb
audit: ensure that 'audit=1' actually enables audit for PID 1

[ Upstream commit 173743dd99a49c956b124a74c8aacb0384739a4c ]

Prior to this patch we enabled audit in audit_init(), which is too
late for PID 1 as the standard initcalls are run after the PID 1 task
is forked.  This means that we never allocate an audit_context (see
audit_alloc()) for PID 1 and therefore miss a lot of audit events
generated by PID 1.

This patch enables audit as early as possible to help ensure that when
PID 1 is forked it can allocate an audit_context if required.

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/audit.c