audit userspace problems with io_uring async ops

[Paul Moore]

On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul at paul-moore.com> wrote:
>
> Hi all,
>
> We just recently started picking up audit-testsuite failures with the
> latest upstream kernels and I tracked it down to a change in how the
> IORING_OP_OPENAT operation is handled, and how Steve's audit userspace
> displays async io_uring ops.  It appears that when ausearch is used to
> look for events it doesn't display async io_uring events (URINGOP
> records/events without an associated SYSCALL record/event).  Take the
> following snippet from /var/log/audit/audit.log ...

Hi Steve,

Before I start working around this in the audit-testsuite I just
wanted to check and see if you already had a fix for ausearch?

-- 
paul-moore.com