Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules

On 14/12/15, Eric Paris wrote: > Lets say I and in the non-init pid namespace. > > I run audictl -a exit,always -S all -F pid=1 That's easy (for now). Line 675 of kernel/audit.c in audit_netlink_ok() called from audit_receive_msg() will prevent that with: if ((task_active_pid_ns(current) != &init_pid_ns)) return -EPERM; > Is the audit system going to show records for what I think is pid=1 or > what the initial pid namespace thinks is pid=1 ?