patch suggested by rgb for fixing auditd logs for clone syscall shows exit code as container namespace pid of child process instead of host namespace

madz car madzcar at
Fri Jan 5 11:00:01 UTC 2018

Hi Guys,

Please refer to the issue details at github :

Here is a patch as suggested by rgb, i can confirm that it works.

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ecc23e2..9a78ecb 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1557,6 +1557,11 @@ void __audit_syscall_exit(int success, long
        struct task_struct *tsk = current;
        struct audit_context *context;
+        rcu_read_lock();
+        return_code = pid_nr(find_vpid((int) return_code));
+        rcu_read_unlock();

        if (success)
                success = AUDITSC_SUCCESS;

Kindly review.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the Linux-audit mailing list