From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: OBJ_PID records Date: Fri, 21 Sep 2007 15:21:39 -0400 Message-ID: <46F419C3.6050608@hp.com> References: <200709211506.56322.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200709211506.56322.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com What are you running? I don't see the OBJ_PID record on a recent RHEL5 U1 snapshot on ia64, but I only tried it once. -- ljk Steve Grubb wrote: > Hi, > > I was noticing that I'm seeing OBJ_PID records sometimes when there is > MAC_POLICY_LOAD event. I didn't think these two would go together. I'm seeing > this: > > type=OBJ_PID msg=audit(09/18/2007 06:26:21.236:216) : opid=3211 > obj=user_u:system_r:unconfined_t:s0 > type=SYSCALL msg=audit(09/18/2007 06:26:21.236:216) : arch=x86_64 > syscall=write success=yes exit=1592854 a0=4 a1=2aaaaaae2000 a2=184e16 a3=0 > items=0 ppid=3333 pid=3334 auid=sgrubb uid=root gid=root euid=root suid=root > fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=load_policy > exe=/usr/sbin/load_policy subj=user_u:system_r:load_policy_t:s0 key=(null) > type=MAC_POLICY_LOAD msg=audit(09/18/2007 06:26:21.236:216) : policy loaded > auid=sgrubb > > Shouldn't these only come out when kill (or its friends) is in effect? The > above syscall was a write. I don't think the current syscall is being taken > into account in audit_match_signal. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit