Re: Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?

[Eric Paris <eparis@redhat.com>]

On Wed, 2014-03-12 at 14:21 -0400, Richard Guy Briggs wrote:
> On 14/03/12, Eric Paris wrote:
> > On Wed, 2014-03-12 at 08:22 -0400, Steve Grubb wrote:
> > > On Tuesday, March 11, 2014 06:15:17 PM Richard Guy Briggs wrote:
> > > > Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
> > > 
> > > Well, pid=0 would be the kernel. So, its valid but unlikely.
> > 
> > Actually, signals from the kernel will never get recorded here...
> > 
> > > Offhand I don't 
> > > know why the kernel might try sending a signal. Is this a problem?
> > 
> > He's trying to figure out how to store this info in light of pid
> > namespaces.  right now, auditd can only live in the initial pid
> > namespace, so can only get signals from processes in the initial pid
> > namespace, so we can store it as a number always in the initial pid
> > namespace.  But if auditd were ever to not be in the initial pid
> > namespace, not sure what to do....
> 
> Nice word column alignment above there Eric...  ;-)
> 
> I would be inclined to always store it in the initial pid namespace and
> then make a decision if it translates sanely when needed to the auditd
> namespace(s).

since for now auditd pid_ns == init pid_ns that's fine.