2 files changed, 6 insertions, 0 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 52f1b12505a9..4d1c2f2fcc1b 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -98,6 +98,7 @@
 #define AUDIT_FD_PAIR           1317    /* audit record for pipe/socketpair */
 #define AUDIT_OBJ_PID           1318    /* ptrace target */
 #define AUDIT_TTY               1319    /* Input on an administrative TTY */
+#define AUDIT_EOE               1320    /* End of multi-record event */
 
 #define AUDIT_AVC               1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR       1401    /* Internal SE Linux Errors */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e67abb02904..6e5de767bad1 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1270,6 +1270,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
                 audit_log_end(ab);
         }
+
+        /* Send end of event record to help user space know we are finished */
+        ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+        if (ab)
+                audit_log_end(ab);
         if (call_panic)
                 audit_panic("error converting sid to string");
 }