Re: [PATCH] Handle timestamp 0.0 in auparse, was Re: audit-viewer help needed

LC Bruzenak píše v Po 22. 09. 2008 v 19:38 -0500: > On Mon, 2008-09-22 at 23:30 +0000, Miloslav Trmač wrote: > > > node=hugo type=AVC msg=audit(0.000:6760): <SNIP> comm="lockd" > > > > I'm curious how this audit record could have been created (notabile is > > that the previous record has a sequence ID 6758 and a reasonable > > timestamp). Lenny, Steve, any ideas? > > I found a couple more: > > [root@hugo ~]# grep "(0.000:" /var/log/audit/audit.log* > <SNIP> type=AVC msg=audit(0.000:6760): <SNIP> comm="lockd" > <SNIP> type=AVC msg=audit(0.000:381): <SNIP> comm="nfsd4" I think I can see what's going on. Those are kernel threads; when they are created, an audit context is created and zeroed. The timestamp is set on system call entry in ordinary threads, but there is no system call entry in kernel threads, so the original zero timestamp is used in all audit records related to kernel threads. I'm not sure how to fix it, though. Perhaps identify "operation start" points in kernel threads, and update the timestamps in their audit contexts at that time?