On Mon, 2012-04-09 at 14:26 -0500, Will Drewry wrote:

On Fri, Apr 6, 2012 at 4:14 PM, Andrew Morton [off-list ref] wrote:

quoted

On Thu, 29 Mar 2012 15:01:54 -0500
Will Drewry [off-list ref] wrote:

quoted

quoted

-void __audit_seccomp(unsigned long syscall)
+void __audit_seccomp(unsigned long syscall, long signr, int code)
 {
      struct audit_buffer *ab;

      ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
-     audit_log_abend(ab, "seccomp", SIGKILL);
+     audit_log_abend(ab, "seccomp", signr);
      audit_log_format(ab, " syscall=%ld", syscall);
+#ifdef CONFIG_COMPAT
+     audit_log_format(ab, " compat=%d", is_compat_task());
+#endif

We don't need the ifdef for compilation reasons now.

The question is: should we emit the compat= record on
non-compat-capable architectures?  Doing so would be safer - making it
conditional invites people to write x86-only usersapce.

I'd certainly prefer it always being there for exactly that reason.

Kees, Eric, any preferences?  Unless I hear one, I'll just drop the
ifdefs in the next revision.

I'd just leave it in unconditionally.  The audit parse libraries would
handle it just fine, but that doesn't mean everyone uses that tool to
parse the text.

-Eric