[PATCH 09/14] signal: Move audit_core_dumps from do_coredump into get_signal

[Eric W. Biederman]

The function audit_core_dumps is not about the coredumps but about
detecting the conditions that would trigger a coredump, and logging
something when that happens.  The function audit_core_dumps runs
even if a coredump never happens.

So move audit_core_dumps out of vfs_coredump and into get_signal
to make it clear it does not care about the actual core dumps.

Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
---
 fs/coredump.c   | 2 --
 kernel/signal.c | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index 2b0b6c3c47ee..700814fc2ff6 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -1199,8 +1199,6 @@ void vfs_coredump(const kernel_siginfo_t *siginfo)
 		.cpu = raw_smp_processor_id(),
 	};
 
-	audit_core_dumps(siginfo->si_signo);
-
 	if (coredump_skip(&cprm, binfmt))
 		return;
 
diff --git a/kernel/signal.c b/kernel/signal.c
index dd00e9879dcf..28e047d76043 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3077,6 +3077,7 @@ bool get_signal(struct ksignal *ksig)
 			if (print_fatal_signals)
 				print_fatal_signal(signr);
 			proc_coredump_connector(current);
+			audit_core_dumps(ksig->info.si_signo);
 			/*
 			 * If it was able to dump core, this kills all
 			 * other threads in the group and synchronizes with
-- 
2.41.0