[RFC][PATCH] loginuid through procfs (+ a question)

Serge E. Hallyn serue at us.ibm.com
Fri Jan 7 23:09:34 UTC 2005


Quoting Steve Grubb (sgrubb at redhat.com):
> On Friday 07 January 2005 17:32, Serge E. Hallyn wrote:
> > > > A related question: ??On receipt of a AUDIT_USER message, we log the
> > > > pid and uid, but not the loginuid. ??
> > >
> > > You mean in af_netlink.c? That info comes from the netlink credentials.
> >
> > No, I meant in audit.c:audit_receive_msg().  
> 
> The user id & pid comes from the credential in that function.
> 
> 312         pid  = NETLINK_CREDS(skb)->pid;
> 313         uid  = NETLINK_CREDS(skb)->uid
> <snip>
> 356         audit_log_format(ab,
> 357              "user pid=%d uid=%d length=%d msg='%.1024s'",
> 358               pid, uid
> 
> Where would the loginuid come from?

It would come from find_task_by_pid(pid)->audit_context->loginuid.

But only if we need it, which is what I'm asking :)

(LSPP seems to require it)

-serge




More information about the Linux-audit mailing list