Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
Richard Guy Briggs
rgb at redhat.com
Wed Mar 12 18:21:15 UTC 2014
On 14/03/12, Eric Paris wrote:
> On Wed, 2014-03-12 at 08:22 -0400, Steve Grubb wrote:
> > On Tuesday, March 11, 2014 06:15:17 PM Richard Guy Briggs wrote:
> > > Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
> >
> > Well, pid=0 would be the kernel. So, its valid but unlikely.
>
> Actually, signals from the kernel will never get recorded here...
>
> > Offhand I don't
> > know why the kernel might try sending a signal. Is this a problem?
>
> He's trying to figure out how to store this info in light of pid
> namespaces. right now, auditd can only live in the initial pid
> namespace, so can only get signals from processes in the initial pid
> namespace, so we can store it as a number always in the initial pid
> namespace. But if auditd were ever to not be in the initial pid
> namespace, not sure what to do....
Nice word column alignment above there Eric... ;-)
I would be inclined to always store it in the initial pid namespace and
then make a decision if it translates sanely when needed to the auditd
namespace(s).
> > -Steve
- RGB
--
Richard Guy Briggs <rbriggs at redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
More information about the Linux-audit
mailing list