On 15/12/10, Paul Moore wrote: > On Thu, Dec 10, 2015 at 5:49 PM, Steve Grubb <[email protected]> wrote: > > On Wed, 09 Dec 2015 12:43:37 +1100 > > Burn Alting <[email protected]> wrote: > > > >> Steve, > >> > >> Can you mock up some examples of an 'enriched' event showing how it is > >> different from what we have now. > > > > type=LOGIN msg=audit(1449782897.896:2496): pid=1768 uid=0 > > subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 old-auid=4294967295 > > auid=4325 old-ses=4294967295 ses=1 res=1 UID="root" OLD-AUID="unset" > > AUID="sgrubb" > > > > type=SYSCALL msg=audit(1449778741.412:4952): arch=c000003e syscall=40 > > success=no exit=-22 a0=3 a1=0 a2=0 a3=4000 items=0 ppid=7362 pid=7994 > > auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > > tty=(none) ses=4294967295 comm="systemd-coredum" > > exe="/usr/lib/systemd/systemd-coredump" > > subj=system_u:system_r:init_t:s0 key="einval-retcode" ARCH=x86_64 > > SYSCALL=sendfile AUID="unset" UID="root" GID="root" EUID="root" > > SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" > > This could be confusing on a system with "unset" as a user.
As we do with "none", "(unset)" might be better? > paul moore - RGB -- Richard Guy Briggs <[email protected]> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
