Re: [PATCH bpf-next v1] bpf: Include pid, uid and comm in audit output

[Yafang Shao <laoar.shao@xxxxxxxxx>]

On Thu, Dec 14, 2023 at 8:07 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote:
>
> Current output from auditd is as follows:
>
> time->Wed Dec 13 21:39:24 2023
> type=BPF msg=audit(1702503564.519:11241): prog-id=439 op=LOAD
>
> This only tells you that a BPF program was loaded, but without
> any context. If we include the pid, uid and comm we get output as
> follows:
>
> time->Wed Dec 13 21:59:59 2023
> type=BPF msg=audit(1702504799.156:99528): pid=27279 uid=0
>         comm="new_name" prog-id=50092 op=UNLOAD

Is it possible to integrate these common details like pid, uid, and
comm into the audit_log_format() function for automatic inclusion? Or
would it be more appropriate to create a new helper function like
audit_log_format_common() dedicated specifically to incorporating
these common details? What are your thoughts on this?

-- 
Regards
Yafang