On Monday, December 15, 2014 01:51:52 PM Eric Paris wrote: > On Mon, 2014-12-15 at 13:50 -0500, Richard Guy Briggs wrote: > > On 14/12/15, Eric Paris wrote: > > > Lets say I and in the non-init pid namespace. > > > > > > I run audictl -a exit,always -S all -F pid=1 > > > > That's easy (for now). Line 675 of kernel/audit.c in audit_netlink_ok() > > > > called from audit_receive_msg() will prevent that with: > > if ((task_active_pid_ns(current) != &init_pid_ns)) > > > > return -EPERM; > > > > > Is the audit system going to show records for what I think is pid=1 or > > > what the initial pid namespace thinks is pid=1 ? > > ACK from me then.
Okay, thanks. Anybody else want to jump on the Ack/Review bandwagon? -- paul moore security and virtualization @ redhat -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
