Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules

[Paul Moore <pmoore@redhat.com>]

On Monday, December 15, 2014 01:50:57 PM Richard Guy Briggs wrote:
> I've still got outstanding patches to store PIDs as struct pid rather
> than pid_t, so this was part of the motivation to start that in this
> code.

Funny you mention this, while I was hunting for the root cause of the problem, 
I had a patch which did just that, adding a pid struct to the audit_field 
struct.  Eventually we will have to go that route as (sadly) a PID is no 
longer sufficient to identify a process on the system, you need PID+ns.  We'll 
still have the find_pid() problem then, but there are ways around that by 
being smarter about how we add/delete/store filtering rules.

I opted for the patch I posted here because as you point out we really only 
work in the init namespace and it didn't muddle the bugfix with new 
functionality.

-- 
paul moore
security and virtualization @ redhat