1 files changed, 27 insertions, 0 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 486c968214d9..da8dc0db5bd3 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2261,6 +2261,33 @@ out:
 }
 
 /**
+ * audit_signal_info - record signal info for shutting down audit subsystem
+ * @sig: signal value
+ * @t: task being signaled
+ *
+ * If the audit subsystem is being terminated, record the task (pid)
+ * and uid that is doing that.
+ */
+int audit_signal_info(int sig, struct task_struct *t)
+{
+        kuid_t uid = current_uid(), auid;
+
+        if (auditd_test_task(t) &&
+            (sig == SIGTERM || sig == SIGHUP ||
+             sig == SIGUSR1 || sig == SIGUSR2)) {
+                audit_sig_pid = task_tgid_nr(current);
+                auid = audit_get_loginuid(current);
+                if (uid_valid(auid))
+                        audit_sig_uid = auid;
+                else
+                        audit_sig_uid = uid;
+                security_task_getsecid(current, &audit_sig_sid);
+        }
+
+        return audit_signal_info_syscall(t);
+}
+
+/**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer
  *