Re: The audit "context" and when to expect it.
On 5/29/2020 12:01 PM, Paul Moore wrote:
On Fri, May 29, 2020 at 1:59 PM Casey Schaufler
<casey(a)schaufler-ca.com> wrote:
> What does a NULL audit context (e.g. ab->cxt == NULL) tell
> me about the status of the audit buffer? It seems like it should
> be telling me that the audit buffer is being created for some
> purpose unrelated to the current task. And yet there are places
> where information is pulled from the current task even when
> the cxt is NULL.
The simple answer is that a NULL audit_context indicates a standalone
record, meaning a record with a unique timestamp so that it is not
associated with any other records into an event. If the audit_context
it not NULL then the information in the context is used to group, or
associate, all of the records sharing that context into a single
event.
OK, so if I want a add a sub-record with the multiple secctx values
for the events that include a subject value I need to change those
events to use an audit_context. Is that going to introduce an
unacceptable memory or performance burden?
This is just one example, but a non-NULL audit_context is how PATH
records end up being associated with SYSCALL records in a single
event.