[RFC][PATCH] loginuid through procfs (+ a question)
Steve Grubb
sgrubb at redhat.com
Sat Jan 8 13:57:34 UTC 2005
On Friday 07 January 2005 18:09, Serge E. Hallyn wrote:
> It would come from find_task_by_pid(pid)->audit_context->loginuid.
>
> But only if we need it, which is what I'm asking :)
>
> (LSPP seems to require it)
OK I see.
But then aren't we back to trusting task-pid is the same one that sent the
packet? What if task-pid exits immediately after sending the packet (and
before audit processes the message)? I think it has to be collected
af_netlink.c since netlink is asynchronous.
-Steve Grubb
More information about the Linux-audit
mailing list