RFE: add a tty field to the AUDIT_LOGIN event about audit-kernel HOT 4 CLOSED

We should be able to record the tty information using logic similar to what we use in audit_log_task_info(), in fact it might be a good idea to split this out into a helper function, e.g. audit_get_tty().

Snippet from audit_log_task_info():

    spin_lock_irq(&tsk->sighand->siglock);
    if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
            tty = tsk->signal->tty->name;
    else
            tty = "(none)";
    spin_unlock_irq(&tsk->sighand->siglock);

from audit-kernel.

While an RFE, this is a rather minor addition and a feature page isn't required, just the usual verbose patch description. However, as with all new changes a corresponding patch for the test suite will be required for kernel patch acceptance.

from audit-kernel.

Pull request for a test: linux-audit/audit-testsuite@a76cc13

Posted a code patch to the mailing list: https://www.redhat.com/archives/linux-audit/2016-April/msg00072.html

from audit-kernel.

FYI, @rgbriggs V4 patch was merged in as commit db0a6fb.

from audit-kernel.