Re: patch suggested by rgb for fixing auditd logs for clone syscall shows exit code as container namespace pid of child process instead of host namespace

On 2018-01-05 13:07, Steve Grubb wrote: Yes, you are right, Steve. This would give bogus return values for all other syscalls. Madzcar, I assume you can confirm that this patch will give incorrect results for all other syscalls for the "exit" field. So, that should be in kernel/fork.c:_do_fork(), or rather, just replace the pid_vnr() call with pid_nr(). However, this will mess up all callers (clone(2), fork(2), vfork(2) kernel_thread(), do_fork()), who expect the return value in the caller's PID namespace, so that won't work. The return value is technically correct for the PID namespace from which it was called and reported correctly in the audit record. Madzcar, the way you are trying to interpret the results from the audit record is clever, but not going to work without another way to translate that value lifted out of the audit record. I don't know if there is a userspace tool or call to translate PIDs between namespaces. - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635