audit userspace problems with io_uring async ops

[Paul Moore]

On Mon, Mar 6, 2023 at 3:58 PM Steve Grubb <sgrubb at redhat.com> wrote:
>
> Hello Paul,
>
> On Monday, March 6, 2023 3:07:37 PM EST Paul Moore wrote:
> > On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul at paul-moore.com> wrote:
> > > Hi all,
> > >
> > > We just recently started picking up audit-testsuite failures with the
> > > latest upstream kernels and I tracked it down to a change in how the
> > > IORING_OP_OPENAT operation is handled, and how Steve's audit userspace
> > > displays async io_uring ops.  It appears that when ausearch is used to
> > > look for events it doesn't display async io_uring events (URINGOP
> > > records/events without an associated SYSCALL record/event).  Take the
> > > following snippet from /var/log/audit/audit.log ...
> >
> > Hi Steve,
> >
> > Before I start working around this in the audit-testsuite I just
> > wanted to check and see if you already had a fix for ausearch?
>
> Thanks for the bug report. I have been out for the last 8 days and now have
> ~3600 unread emails. I will try look into this tomorrow.

Great thanks.  I'll hold off an a workaround.

-- 
paul-moore.com