On Tue, Aug 30, 2016 at 11:03 AM, Steve Grubb <sgrubb@xxxxxxxxxx> wrote: > On Wednesday, August 17, 2016 4:58:02 PM EDT Paul Moore wrote: >> On Tue, Jul 26, 2016 at 10:54 AM, Jeff Vander Stoep <jeffv@xxxxxxxxxx> wrote: >> > dump_common_audit_data() currently contains a field for pid, but the >> > value printed is actually the thread ID, tid. Update this value to >> > return the task group ID. Add a new field for tid. With this change >> > the values printed by audit now match the values returned by the >> > getpid() and gettid() syscalls. >> > >> > Signed-off-by: Jeff Vander Stoep <jeffv@xxxxxxxxxx> >> > --- >> > >> > security/lsm_audit.c | 7 +++++-- >> > 1 file changed, 5 insertions(+), 2 deletions(-) >> >> Hi Jeff, >> >> Have you tested this against the audit-testsuite[1]? We don't have an >> explicit PID test yet, but at least two of the tests do test it as a >> side effect. >> >> Steve, I don't see the thread ID listed in the field dictionary, are >> you okay with using "tid" for this? > > Yes. Can someone add both? Yes, I'll add "tid" to the field DB once we commit the kernel patch. >> However, as far as I can see, the biggest problem with this patch is >> that it adds a field in the middle of a record which will likely cause >> the audit userspace tools to explode (or so I've been warned in the >> past). Steve, what say you about the userspace? > > This is OK. After picking out pid, search utiliies scan for comm. They will > just skip over the new field. If fields that we normally search change order, > then we have a problem. > > So, ACK on my end. Okay, thanks. If we blow up your userspace I'll remind you of this conversation ;) -- paul moore www.paul-moore.com _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
