On Thursday 06 January 2005 19:42, Serge Hallyn wrote:
I'm testing it by hacking auditctl.c to do an
execl("/bin/sh",
"/bin/sh"); if it was called on a -L. Before the "auditctl -L 25,ab"
my
loginuid is -1, after (on, say, a "auditctl -m cd") it is 25. Without
the patch, it is always -1.
That's what I noticed and made me say I didn't think it was working right.
Is that (-1 default loginuid until PAM sets it) the desired behavior?
If there is no logins, there's nothing to *set* the user ID. The number
returned needs to be fictional so its not mistaken for root or a real user.
-Steve Grubb