patch suggested by rgb for fixing auditd logs for clone syscall shows exit code as container namespace pid of child process instead of host namespace
madz car
madzcar at gmail.com
Fri Jan 5 11:00:01 UTC 2018
Hi Guys,
Please refer to the issue details at github :
https://github.com/linux-audit/audit-kernel/issues/68
Here is a patch as suggested by rgb, i can confirm that it works.
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ecc23e2..9a78ecb 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1557,6 +1557,11 @@ void __audit_syscall_exit(int success, long
return_code)
{
struct task_struct *tsk = current;
struct audit_context *context;
+
+ rcu_read_lock();
+ return_code = pid_nr(find_vpid((int) return_code));
+ rcu_read_unlock();
+
if (success)
success = AUDITSC_SUCCESS;
Kindly review.
Regards,
Madzcar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20180105/1f05301f/attachment.htm>
More information about the Linux-audit
mailing list