Paul Moore

For example, here is Linus' tree from October 7, 2020: ``` % grep "task_pid_nr" kernel/audit*.c kernel/audit.c: task_pid_nr(current), kernel/auditfilter.c: pid = task_pid_nr(current); kernel/auditsc.c: audit_log_format(ab, " pid=%u", task_pid_nr(current)); ```

> A patch adding fallocate and renameat2 was sent to mail list: https://www.redhat.com/archives/linux-audit/2017-October/msg00048.html ... and it was merged via c372801813f5a52fc3cea869751116d20765e1dd.

@stevegrubb I know we talked about this a while ago, but I forgot the end result of the discussion ... Above you mention needing to review a range of syscalls,...

Okay, leaving it open.

The last upstream patchset from April 2015: * https://www.redhat.com/archives/linux-audit/2015-April/msg00014.html

I wonder if we could do something by keying off of `audit_default` and the multicast listener state. For example: * `audit_default == AUDIT_OFF` and multicast listeners (likely the default for...

Patches are always welcome folks :) Want to try your hand at writing kernel audit patches @lucab or @poettering ?

Likely because it wasn't sent to the linux-audit mailing list. I don't see the patch in either the December 2014 or January 2015 archives: * https://www.redhat.com/archives/linux-audit/2014-December/thread.html * https://www.redhat.com/archives/linux-audit/2015-January/thread.html Rebase the...

I strongly encourage technical discussions to move to the linux-audit mailing list, we use the GH issue tracker primarily as a public "todo list" and an easy way to track...

> Edit: Please disregard. This comment was meant to be made somehwere else. Thanks, I was just about to come here and ask: "what meeting?" :)