[RFC][PATCH] loginuid through procfs (+ a question)

Steve Grubb sgrubb at redhat.com
Sat Jan 8 13:57:34 UTC 2005


On Friday 07 January 2005 18:09, Serge E. Hallyn wrote:
> It would come from find_task_by_pid(pid)->audit_context->loginuid.
>
> But only if we need it, which is what I'm asking :)
>
> (LSPP seems to require it)

OK I see. 

But then aren't we back to trusting task-pid is the same one that sent the 
packet? What if task-pid exits immediately after sending the packet (and 
before audit processes the message)? I think it has to be collected 
af_netlink.c since netlink is asynchronous.

-Steve Grubb




More information about the Linux-audit mailing list