Re: [PATCH] qemu: Add audit entries for suspend and resume

On 12/17/24 00:56, Jim Fehlig via Devel wrote:

We recently received a request from certification auditors to provide audit entries for suspend and resume. This small patch uses the existing virtDomainAudit{Start,Stop} functions with new reasons "suspended" and "resumed".

Signed-off-by: Jim Fehlig <jfehlig@suse.com> ---

For suspend, I initially wrote the following

virDomainAuditStart(vm, virDomainPausedReasonTypeToString(reason), true);

but I'm not sure it makes sense in resume, where we have reasons such as VIR_DOMAIN_CRASHED_PANICKED. For symmetry, it seemed best to go with "suspended" and "resumed".

src/qemu/qemu_driver.c | 2 ++ 1 file changed, 2 insertions(+)

Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Michal