On 16/04/26, Deepika Sundar wrote: [re-adding the list] This is always the initial PID namespace in the audit logs for now, which are with respect to the initial PID namespace. The kernel knows from which namespace a request is made and if it were possible to have a process in a non-initial PID namespace query the kernel, it would get back an answer relative to that namespace. That is not currently possible. - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635