Paul Moore
Paul Moore
It seems like attempting something similar, but with *just* the audit info (audit login ID, session ID) might be a place to start.
Adding @stevegrubb as I suspect he might have a quick answer for this.
@aconite33 I assure you we are probably more alike then we are different. Perhaps the only noteworthy difference is that I break the kernel a bit more often ;) Yes,...
I'm not aware of any work in this area.
My network access is unreliable, but I happen to have it for the moment so I did a quick test on an upstream kernel (the only one I have immediate...
Unless I'm mistaken @BunsExynos, that issue appears unrelated to this problem mentioned here, yes?
@rgbriggs let's be sure to add a soft link test to the exec_name test in the test suite once this is resolved. We should probably a test for a hard...
@rgbriggs I'm going to assign this to you since it looks like this is already on your todo list, if not please let me know and I'll reassign it.
This is ongoing work.
Hmm, two things come to mind for debugging next steps: * The `audit_state` enum does not have explicit assignments so it's possible that the `context->current_state` check in `__audit_syscall_exit()` may not...