Re: [PATCH bpf-next v1] bpf: Include pid, uid and comm in audit output

[Yafang Shao <laoar.shao@xxxxxxxxx>]

On Thu, Dec 14, 2023 at 9:13 PM Yafang Shao <laoar.shao@xxxxxxxxx> wrote:
>
> On Thu, Dec 14, 2023 at 8:07 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote:
> >
> > Current output from auditd is as follows:
> >
> > time->Wed Dec 13 21:39:24 2023
> > type=BPF msg=audit(1702503564.519:11241): prog-id=439 op=LOAD
> >
> > This only tells you that a BPF program was loaded, but without
> > any context. If we include the pid, uid and comm we get output as
> > follows:
> >
> > time->Wed Dec 13 21:59:59 2023
> > type=BPF msg=audit(1702504799.156:99528): pid=27279 uid=0
> >         comm="new_name" prog-id=50092 op=UNLOAD
>
> Is it possible to integrate these common details like pid, uid, and
> comm into the audit_log_format() function for automatic inclusion? Or
> would it be more appropriate to create a new helper function like
> audit_log_format_common() dedicated specifically to incorporating
> these common details? What are your thoughts on this?

BTW, bpf prog can be unloaded in irq context. Therefore we can't do it
for BPF_AUDIT_UNLOAD.

-- 
Regards
Yafang