From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message? Date: Wed, 12 Mar 2014 14:27:13 -0400 Message-ID: <1394648833.31201.3.camel@flatline.rdu.redhat.com> References: <20140311221517.GA15334@madcap2.tricolour.ca> <3280036.UE6vvtA28r@x2> <1394642105.31201.2.camel@flatline.rdu.redhat.com> <20140312182115.GA27244@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20140312182115.GA27244@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2014-03-12 at 14:21 -0400, Richard Guy Briggs wrote: > On 14/03/12, Eric Paris wrote: > > On Wed, 2014-03-12 at 08:22 -0400, Steve Grubb wrote: > > > On Tuesday, March 11, 2014 06:15:17 PM Richard Guy Briggs wrote: > > > > Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message? > > > > > > Well, pid=0 would be the kernel. So, its valid but unlikely. > > > > Actually, signals from the kernel will never get recorded here... > > > > > Offhand I don't > > > know why the kernel might try sending a signal. Is this a problem? > > > > He's trying to figure out how to store this info in light of pid > > namespaces. right now, auditd can only live in the initial pid > > namespace, so can only get signals from processes in the initial pid > > namespace, so we can store it as a number always in the initial pid > > namespace. But if auditd were ever to not be in the initial pid > > namespace, not sure what to do.... > > Nice word column alignment above there Eric... ;-) > > I would be inclined to always store it in the initial pid namespace and > then make a decision if it translates sanely when needed to the auditd > namespace(s). since for now auditd pid_ns == init pid_ns that's fine.