[PATCH v28 22/25] Audit: Add record for multiple process LSM attributes

Casey Schaufler casey at schaufler-ca.com
Wed Aug 18 21:59:31 UTC 2021

On 8/16/2021 11:57 AM, Paul Moore wrote:
> On Fri, Aug 13, 2021 at 5:47 PM Casey Schaufler <casey at schaufler-ca.com> wrote:
>> On 8/13/2021 1:43 PM, Paul Moore wrote:
> Yeah, the thought occurred to me, but we are clearly already in the
> maybe-the-assumptions-are-wrong stage so I'm not going to rely on that
> being 100%.  We definitely need to track this down before we start
> making to many more guesses about what is working and what is not.

I've been tracking down where the audit context isn't set where
we'd expect it to be, I've identified 5 cases:

	1000	AUDIT_GET 		- Get Status
	1001	AUDIT_SET 		- Set status enable/disable/auditd

These are all events that relate to the audit system itself.
It seems plausible that these really aren't syscalls and hence
shouldn't be expected to have an audit_context. I will create a
patch that treats these as the special cases I believe them to be.

More information about the Linux-security-module-archive mailing list