Re: audit looks unmaintained? [was: Re: [PATCH 11/12] pid: rewrite task helper functions avoiding task->pid and task->tgid]

On Friday, August 30, 2013 03:06:46 PM Richard Guy Briggs wrote: You don't want to clear the TIF audit flag when context == NULL. What that will do is make a bunch of inauditable processes. There are times when audit is disabled and then re-enabled later. If the flag gets cleared, then a task's syscall will never enter the auditing framework from kernel/entry_64.S. That flag is 0 when auditing has never ever been enabled. If auditing is enabled, it should always be a 1 unless the task filter has determined that this process should not be audited ever. In practice, this is almost never used. But ensuring the TIF_SYSCALL_AUDIT set to 1 on all processes is why we have the boot argument. Not setting audit=1 on the boot arguments means that any process running before the audit daemon enables auditing can never ever be audited because the only place its set is when processes are cloned. Hope this clears up the use. NAK to the patch, it'll break auditing. -Steve