Re: [PATCH] LOGIN message credentials
On Mon, 25 Apr 2005 12:14:24 EDT, Steve Grubb said:
type=LOGIN msg=audit(1114444861.363:0): login pid=0 uid=0 old
loginuid=4294967295 new loginuid=0
The pid cannot be 0. The problem is that the kernel code assumes the
information is in the audit context. What if audit_get_context has never been
called for that process?
OK.. I'll bite - why wasn't audit_get_context called? Unless we've looked at
it and decided that it's a reasonable thing to happen, your patch is just
papering over a bug that will come back to bite us later...
Attachments:
- attachment.sig (application/pgp-signature — 226 bytes)