[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules



On Mon, 2014-12-15 at 13:50 -0500, Richard Guy Briggs wrote:
> On 14/12/15, Eric Paris wrote:
> > Lets say I and in the non-init pid namespace.
> > 
> > I run audictl -a exit,always -S all -F pid=1
> 
> That's easy (for now).  Line 675 of kernel/audit.c in audit_netlink_ok()
> called from audit_receive_msg() will prevent that with:
> 
> 	if ((task_active_pid_ns(current) != &init_pid_ns))
> 		return -EPERM;
> 
> > Is the audit system going to show records for what I think is pid=1 or
> > what the initial pid namespace thinks is pid=1 ?

ACK from me then.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]