From 8805ca53e76b31b5cea4ff6738f7c81c339e19d9 Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Sun, 2 Mar 2008 21:34:17 +0000 Subject: [PATCH] Rather than copying out the full audit trigger record, which includes a queue entry field, just copy out the unsigned int that is the trigger message. In practice, auditd always requested sizeof(unsigned int), so the extra bytes were ignored, but copying them out was not the intent. MFC after: 1 month --- sys/security/audit/audit_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/security/audit/audit_trigger.c b/sys/security/audit/audit_trigger.c index 1cf1be2dd3f..562c45028ac 100644 --- a/sys/security/audit/audit_trigger.c +++ b/sys/security/audit/audit_trigger.c @@ -113,7 +113,7 @@ audit_read(struct cdev *dev, struct uio *uio, int ioflag) } mtx_unlock(&audit_trigger_mtx); if (!error) { - error = uiomove(ti, sizeof *ti, uio); + error = uiomove(&ti->trigger, sizeof(ti->trigger), uio); free(ti, M_AUDITTRIGGER); } return (error);