euid missing

[Chris Nandor]

As mentioned in previous e-mail, we want to log what users do as root.  I
have these two rules, only:

-a exit,always -F arch=b32 -F euid=0 -F auid>=0 -F auid!=4294967295 -S
execve -k rootcmd
-a exit,always -F arch=b64 -F euid=0 -F auid>=0 -F auid!=4294967295 -S
execve -k rootcmd

But this line shows up:

node=grax.sea.marchex.com type=ANOM_ABEND
msg=audit(1468426871.752:3282575): auid=811 uid=811 gid=811 ses=12
pid=18504 comm="chromium-browse" reason="seccomp" sig=0 syscall=91 compat=0
ip=0x7f296c759c77 code=0x50001

My guess is that it is because euid is missing; maybe euid=0 is true if
euid is null?  I could put uid=0, instead of euid ... but that isn't
exactly what I want, I think.  Is there a way to have the rule require euid
actually be 0?

--Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20160713/8e3aea7b/attachment.htm>