Paul Moore comments

Results 276 comments of


                                            Paul Moore

RFE: filter_exclude search by syscall/key, syncmarker fix, comments

Hi @rgbriggs, I'm just checking in on this PR; are you planning to make the requested change above?

RFE: add test for filter_exit

Hi @The-Mule, this looks good but can you add your sign-off? * https://github.com/linux-audit/audit-testsuite/blob/main/CONTRIBUTING.md#sign-your-work

RFE: add test for filter_exit

Hi @The-Mule - ping?

BUG: auditd logs for clone syscall shows exit code as container namespace pid of child process instead of host namespace pid

@madzcar I haven't had time to look into this issue, or the solution that @rgbriggs proposed, but you can always feel free to submit patches to the mailing list and...

ghak28: test multicast join and part events without the perl socket netlink library dependancy

Can we get a better name for this PR? :)

ghak28: test multicast join and part events without the perl socket netlink library dependancy

Yes, thanks.

RFE: test for audit container ID functionality

Great, thanks for letting me know. I went ahead and assigned this task to both of you :)

RFE: ARG_PATH record

Doing this would require a lot of syscall specific code. I'm not saying "no", but this is extremely low priority.

RFE: add tests for UID/GID event filtering

@The-Mule great, thanks!

BUG: fix aliasing UB in the BPF simulator

Hi @q66, thank you for the patch! It looks good to me, but we do ask that contributors use their real name in their DCO sign-off. Would you mind updating...