On Friday 07 January 2005 18:09, Serge E. Hallyn wrote:
It would come from
find_task_by_pid(pid)->audit_context->loginuid.
But only if we need it, which is what I'm asking :)
(LSPP seems to require it)
OK I see.
But then aren't we back to trusting task-pid is the same one that sent the
packet? What if task-pid exits immediately after sending the packet (and
before audit processes the message)? I think it has to be collected
af_netlink.c since netlink is asynchronous.
-Steve Grubb