audit-kernel
audit-kernel copied to clipboard
RFE: clone3() syscall needs a dedicated record
The clone3 syscall moves most parameters to struct clone_args. Flags, pidfd, exit_signal, and cgroup are of interest. The pidfd is only of interest if it has been resolved to the fd number - we do not want it's address.