Re: [PATCH 2/5] audit: convert PPIDs to the inital PID namespace.

From: Oleg Nesterov
Date: Mon Dec 30 2013 - 12:07:24 EST


On 12/23, Richard Guy Briggs wrote:
>
> @@ -1839,10 +1839,10 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
> spin_unlock_irq(&tsk->sighand->siglock);
>
> audit_log_format(ab,
> - " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
> + " ppid=%d pid=%d auid=%u uid=%u gid=%u"
> " euid=%u suid=%u fsuid=%u"
> " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
> - sys_getppid(),
> + task_ppid_nr(tsk),

Hmm. But sys_getppid() returns tgid, not pid.

This probably means that 1/5 should use task_tgid_nr_*() ?

Note that ->real_parent is not necessarily the group leader.

> @@ -459,7 +459,7 @@ static int audit_filter_rules(struct task_struct *tsk,
> case AUDIT_PPID:
> if (ctx) {
> if (!ctx->ppid)
> - ctx->ppid = sys_getppid();
> + ctx->ppid = task_ppid_nr(tsk);

The same.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/