audit: fix formatting of AUDIT_CONFIG_CHANGE events

The AUDIT_CONFIG_CHANGE events sometimes use a op= field. The current
code logs the value of the field with quotes. This field is documented
to not be encoded, so it should not have quotes.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: reformatted commit description to make checkpatch.pl happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 1 insertions, 2 deletions

diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 25772476fa4a..055f11b0a50f 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -458,8 +458,7 @@ static void audit_tree_log_remove_rule(struct audit_krule *rule)
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
         if (unlikely(!ab))
                 return;
-        audit_log_format(ab, "op=");
-        audit_log_string(ab, "remove_rule");
+        audit_log_format(ab, "op=remove_rule");
         audit_log_format(ab, " dir=");
         audit_log_untrustedstring(ab, rule->tree->pathname);
         audit_log_key(ab, rule->filterkey);