On Mon, Mar 6, 2023 at 3:58 PM Steve Grubb <sgr...@redhat.com> wrote: > > Hello Paul, > > On Monday, March 6, 2023 3:07:37 PM EST Paul Moore wrote: > > On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <p...@paul-moore.com> wrote: > > > Hi all, > > > > > > We just recently started picking up audit-testsuite failures with the > > > latest upstream kernels and I tracked it down to a change in how the > > > IORING_OP_OPENAT operation is handled, and how Steve's audit userspace > > > displays async io_uring ops. It appears that when ausearch is used to > > > look for events it doesn't display async io_uring events (URINGOP > > > records/events without an associated SYSCALL record/event). Take the > > > following snippet from /var/log/audit/audit.log ... > > > > Hi Steve, > > > > Before I start working around this in the audit-testsuite I just > > wanted to check and see if you already had a fix for ausearch? > > Thanks for the bug report. I have been out for the last 8 days and now have > ~3600 unread emails. I will try look into this tomorrow.
Great thanks. I'll hold off an a workaround. -- paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
