On Tue, 18 Jan 2005 09:50:37 EST, Stephen Smalley said:
run from a user session and should thus already be auditable. Given
that an audit context is always set up unless the task is explicitly
marked non-auditable, and the only task likely to be marked
non-auditable is the audit daemon itself, I'm not sure why it matters.
Where do kernel-spawned threads like kjournald or the IRQ threads in Ingo's RT
patch end up?