Re: OBJ_PID records

Linda Knippers
2007-09-21T19:21:39Z

What are you running? I don't see the OBJ_PID record on a recent
RHEL5 U1 snapshot on ia64, but I only tried it once.

-- ljk

Steve Grubb wrote:
> Hi,
>
> I was noticing that I'm seeing OBJ_PID records sometimes when there is
> MAC_POLICY_LOAD event. I didn't think these two would go together. I'm seeing
> this:
>
> type=OBJ_PID msg=audit(09/18/2007 06:26:21.236:216) : opid=3211
> obj=user_u:system_r:unconfined_t:s0
> type=SYSCALL msg=audit(09/18/2007 06:26:21.236:216) : arch=x86_64
> syscall=write success=yes exit=1592854 a0=4 a1=2aaaaaae2000 a2=184e16 a3=0
> items=0 ppid=3333 pid=3334 auid=sgrubb uid=root gid=root euid=root suid=root
> fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=load_policy
> exe=/usr/sbin/load_policy subj=user_u:system_r:load_policy_t:s0 key=(null)
> type=MAC_POLICY_LOAD msg=audit(09/18/2007 06:26:21.236:216) : policy loaded
> auid=sgrubb
>
> Shouldn't these only come out when kill (or its friends) is in effect? The
> above syscall was a write. I don't think the current syscall is being taken
> into account in audit_match_signal.
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit