From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve <m6x@ornl.gov>
Subject: auid bug
Date: Thu, 20 Jul 2006 10:08:15 -0400
Message-ID: <44BF8E4F.3000405@ornl.gov>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k6KE8Jtk026002
	for <linux-audit@redhat.com>; Thu, 20 Jul 2006 10:08:19 -0400
Received: from emroute1.ornl.gov (emroute1.ornl.gov [160.91.4.119])
	by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k6KE8Icq019873
	for <linux-audit@redhat.com>; Thu, 20 Jul 2006 10:08:18 -0400
Received: from emroute1.ornl.gov (localhost [127.0.0.1])
	by emroute1.ornl.gov (PMDF V6.2-1x9 #31038)
	with ESMTP id <0J2P00LJDGLTYL@emroute1.ornl.gov> for
	linux-audit@redhat.com; Thu, 20 Jul 2006 10:08:17 -0400 (EDT)
Received: from ORNLEXCHANGE.ornl.gov (ornlexchange1.ornl.gov [160.91.1.20])
	by emroute1.ornl.gov (PMDF V6.2-1x9 #31038)
	with ESMTP id <0J2P00KGWGLS69@emroute1.ornl.gov> for
	linux-audit@redhat.com; Thu, 20 Jul 2006 10:08:17 -0400 (EDT)
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

I am receiving audit events with an odd auid...  I am not sure if this 
is something wrong in the kernel or in audit.  The auid I am receiving 
is 4294967295 (the max value for an unsigned long).  The other uid/gid 
information is normal.

I have seen this on all audit versions since audit-1.2.3, and noticed it 
using the following kernels:

2.6.17-1.2293.2.2_FC6.lspp.38.i686
2.6.17-1.2293.2.2_FC6.lspp.44.i686

The first time I noticed this was after the filter_key patch I applied 
to audit-1.2.3, but it may have nothing to do with that patch.  I 
mentioned it then:

https://www.redhat.com/archives/linux-audit/2006-June/msg00086.html

There is an example record from the audit dispatcher there.

These events are coming straight from the real-time audit dispatcher.

Steve