Re: audit userspace problems with io_uring async ops

Hi all, We just recently started picking up audit-testsuite failures with the latest upstream kernels and I tracked it down to a change in how the IORING_OP_OPENAT operation is handled, and how Steve's audit userspace displays async io_uring ops. It appears that when ausearch is used to look for events it doesn't display async io_uring events (URINGOP records/events without an associated SYSCALL record/event). Take the following snippet from /var/log/audit/audit.log ...