Quoting Steve Grubb (sgrubb(a)redhat.com):
On Friday 07 January 2005 16:58, Serge Hallyn wrote:
> A related question: ??On receipt of a AUDIT_USER message, we log the pid
> and uid, but not the loginuid. ??
You mean in af_netlink.c? That info comes from the netlink credentials.
No, I meant in audit.c:audit_receive_msg(). For instance, upon execution
of passwd, the loginuid should be associated with the AUDIT_USER msg
emitted, right?
-serge