Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

On 2017-10-11 20:57, Richard Guy Briggs wrote: > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > application execution (SYSCALL execve). This is not expected as it was > supposed to be limited to when the file system actually had capabilities > in an extended attribute. It lists all capabilities making the event > really ugly to parse what is happening. The PATH record correctly > records the setuid bit and owner. Suppress the BPRM_FCAPS record on > set*id. <crickets> Serge? James? Can one of you two take this via your trees since Paul has backed down citing (reasonably) that it is mostly capabilities patches rather than audit?