audit: use ktime_get_coarse_real_ts64() for timestamps
Commitc72051d577
("audit: use ktime_get_coarse_ts64() for time access") converted audit's use of current_kernel_time64() to the new ktime_get_coarse_ts64() function. Unfortunately this resulted in incorrect timestamps, e.g. events stamped with the year 1969 despite it being 2018. This patch corrects this by using ktime_get_coarse_real_ts64() just like the current_kernel_time64() wrapper. Fixes:c72051d577
("audit: use ktime_get_coarse_ts64() for time access") Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
parent
c72051d577
commit
290e44b7dd
@ -1721,7 +1721,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
|
||||
struct timespec64 *t, unsigned int *serial)
|
||||
{
|
||||
if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
|
||||
ktime_get_coarse_ts64(t);
|
||||
ktime_get_coarse_real_ts64(t);
|
||||
*serial = audit_serial();
|
||||
}
|
||||
}
|
||||
|
@ -1543,7 +1543,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
|
||||
context->in_syscall = 1;
|
||||
context->current_state = state;
|
||||
context->ppid = 0;
|
||||
ktime_get_coarse_ts64(&context->ctime);
|
||||
ktime_get_coarse_real_ts64(&context->ctime);
|
||||
}
|
||||
|
||||
/**
|
||||
|
Loading…
Reference in New Issue
Block a user