From db38a251025ba34a4c62745ee73647452fd44585 Mon Sep 17 00:00:00 2001 From: rwatson Date: Sun, 2 Mar 2008 21:34:17 +0000 Subject: Rather than copying out the full audit trigger record, which includes a queue entry field, just copy out the unsigned int that is the trigger message. In practice, auditd always requested sizeof(unsigned int), so the extra bytes were ignored, but copying them out was not the intent. MFC after: 1 month --- sys/security/audit/audit_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys') diff --git a/sys/security/audit/audit_trigger.c b/sys/security/audit/audit_trigger.c index 1cf1be2..562c450 100644 --- a/sys/security/audit/audit_trigger.c +++ b/sys/security/audit/audit_trigger.c @@ -113,7 +113,7 @@ audit_read(struct cdev *dev, struct uio *uio, int ioflag) } mtx_unlock(&audit_trigger_mtx); if (!error) { - error = uiomove(ti, sizeof *ti, uio); + error = uiomove(&ti->trigger, sizeof(ti->trigger), uio); free(ti, M_AUDITTRIGGER); } return (error); -- cgit v1.1