summaryrefslogtreecommitdiff
path: root/include/linux/audit.h
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2008-01-07 13:49:15 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2008-02-01 14:07:19 -0500
commitc0641f28dcbecb6dc34a4fd003a9947fcd080696 (patch)
tree75cc2700afe2e83834895e7f45c7f663faf2e034 /include/linux/audit.h
parent4746ec5b01ed07205a91e4f7ed9de9d70f371407 (diff)
[AUDIT] Add End of Event record
This patch adds an end of event record type. It will be sent by the kernel as the last record when a multi-record event is triggered. This will aid realtime analysis programs since they will now reliably know they have the last record to complete an event. The audit daemon filters this and will not write it to disk. Signed-off-by: Steve Grubb <sgrubb redhat com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'include/linux/audit.h')
-rw-r--r--include/linux/audit.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 52f1b12505a9..4d1c2f2fcc1b 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -98,6 +98,7 @@
#define AUDIT_FD_PAIR 1317 /* audit record for pipe/socketpair */
#define AUDIT_OBJ_PID 1318 /* ptrace target */
#define AUDIT_TTY 1319 /* Input on an administrative TTY */
+#define AUDIT_EOE 1320 /* End of multi-record event */
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */