From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: [PATCH] add uid and comm to OBJ_PID records
Date: Mon, 10 Dec 2007 16:02:43 -0500 [thread overview]
Message-ID: <200712101602.43895.sgrubb@redhat.com> (raw)
In-Reply-To: <475DA03C.2050502@hp.com>
On Monday 10 December 2007 15:23:24 Linda Knippers wrote:
> > type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018
> > obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop
>
> Is uid sufficient or do you need auid, gid, euid, suid, fsuid, egid,...
> as well?
I don't think you need fsuid or any of the group credentials for signals. I
also don't think euid matters for receiving signals. auid could be useful.
People were mostly asking what process is this about, pid is generally not
helpful. And they wanted to make sure it was legal for that process to be
getting a signal. So, you need to see the uid.
> The subject has exe as well as comm. Should the obj record
> also have both?
Not 100% sure, but...I don't think we can get at it from the signal path
without holding a lock. We are trying to get what we can without any
complication or performance impact.
-Steve
prev parent reply other threads:[~2007-12-10 21:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-10 20:12 [PATCH] add uid and comm to OBJ_PID records Eric Paris
2007-12-10 20:23 ` Linda Knippers
2007-12-10 21:02 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200712101602.43895.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.