[RFC][PATCH] loginuid through procfs (+ a question)
Serge E. Hallyn
serue at us.ibm.com
Fri Jan 7 23:09:34 UTC 2005
Quoting Steve Grubb (sgrubb at redhat.com):
> On Friday 07 January 2005 17:32, Serge E. Hallyn wrote:
> > > > A related question: ??On receipt of a AUDIT_USER message, we log the
> > > > pid and uid, but not the loginuid. ??
> > >
> > > You mean in af_netlink.c? That info comes from the netlink credentials.
> >
> > No, I meant in audit.c:audit_receive_msg().
>
> The user id & pid comes from the credential in that function.
>
> 312 pid = NETLINK_CREDS(skb)->pid;
> 313 uid = NETLINK_CREDS(skb)->uid
> <snip>
> 356 audit_log_format(ab,
> 357 "user pid=%d uid=%d length=%d msg='%.1024s'",
> 358 pid, uid
>
> Where would the loginuid come from?
It would come from find_task_by_pid(pid)->audit_context->loginuid.
But only if we need it, which is what I'm asking :)
(LSPP seems to require it)
-serge
More information about the Linux-audit
mailing list