Appreciate your response on this issue. However, if you would notice the pid and ppid values in the same log is in the initial namespace, while the exit code is in a different namespace. Doesnt this make the audit log inconsistent? How is an application supposed to analyse the logs when a single log spans multiple namespaces ? How does an application parsing the logs get to know if its actually a different pid namespace other than relying on audit to provide consistent information in the log?
I agree it can mess up other system calls, but atleast in this case for clone, this issue should be fixed somehow. The audit logs having pid and ppids in different namespace and exit codes in different namespace is just making the log impossible to parse. Some of these connections(ssh etc) can be extremely shortlived and as such audit logs are the only way to track such events which is not possible without fixing this issue.
Shouldnt we use one namespace in the log and as such all pid, ppids and exit codes should be translated to that namespace for the log ?