On Friday, January 27, 2012 11:37:00 AM Marcelo Cerri wrote: > I submitted a patch to libvirt to add the qemu pid (vm-pid) to the > VIRT_CONTROL audit record. > > I'm using this field to correlate anomaly events to guest in auvirt and > as a fallback it tries to use the SELinux context for that.
OK, that sounds great. Its probably the best way to handle the situation. Do, you have a link to the patch or commit message? Thanks, -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
