From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules Date: Mon, 15 Dec 2014 14:14:25 -0500 Message-ID: <2949504.5MHzOgfemX@sifl> References: <20141215171414.30169.46068.stgit@localhost> <1418664592.3145.3.camel@redhat.com> <20141215185057.GA6439@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20141215185057.GA6439@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, December 15, 2014 01:50:57 PM Richard Guy Briggs wrote: > I've still got outstanding patches to store PIDs as struct pid rather > than pid_t, so this was part of the motivation to start that in this > code. Funny you mention this, while I was hunting for the root cause of the problem, I had a patch which did just that, adding a pid struct to the audit_field struct. Eventually we will have to go that route as (sadly) a PID is no longer sufficient to identify a process on the system, you need PID+ns. We'll still have the find_pid() problem then, but there are ways around that by being smarter about how we add/delete/store filtering rules. I opted for the patch I posted here because as you point out we really only work in the init namespace and it didn't muddle the bugfix with new functionality. -- paul moore security and virtualization @ redhat