[RFC][PATCH] loginuid through procfs (+ a question)

Steve Grubb sgrubb at redhat.com
Fri Jan 7 22:48:34 UTC 2005


On Friday 07 January 2005 17:32, Serge E. Hallyn wrote:
> > > A related question: ??On receipt of a AUDIT_USER message, we log the
> > > pid and uid, but not the loginuid. ??
> >
> > You mean in af_netlink.c? That info comes from the netlink credentials.
>
> No, I meant in audit.c:audit_receive_msg().  

The user id & pid comes from the credential in that function.

312         pid  = NETLINK_CREDS(skb)->pid;
313         uid  = NETLINK_CREDS(skb)->uid
<snip>
356         audit_log_format(ab,
357              "user pid=%d uid=%d length=%d msg='%.1024s'",
358               pid, uid

Where would the loginuid come from?

-Steve




More information about the Linux-audit mailing list