On Wed, Dec 16, Tomas Mraz wrote:
I discussed with Steve Grubb who is the libaudit and auditd author
to
relax the conditions for failure on auditing. Currently the audit
failure is non-fatal only in case the error return from libaudit is
-EPERM and the real uid is 0. That works fine for screensavers and other
non-root applications however if more fine grained capability handling
is used and in containers this does not work well. We agreed that the
check for real uid should be dropped and treat the -EPERM as nonfatal
error as it can only happen intentionally or because of misconfiguration
(for example a bug in SELinux policy). It should not be possible to
trigger it on demand of attacker.
This patch achieves the above. OK to commit it?
Fine for me.
Thorsten
--
Thorsten Kukuk, Senior Architect SLES & Common Code Base
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)