[Bug 185034] audit(8): audit -s do not sync audit_user

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Thu Jan 7 12:50:26 UTC 2016


Christian Brueffer <brueffer at FreeBSD.org> changed:

           What    |Removed                     |Added
         Resolution|---                         |Works As Intended
                 CC|                            |brueffer at FreeBSD.org
             Status|In Progress                 |Closed
           Assignee|freebsd-bugs at FreeBSD.org    |brueffer at FreeBSD.org

--- Comment #1 from Christian Brueffer <brueffer at FreeBSD.org> ---
Hi Radim, the information which flags to audit for a user are not managed by
auditd, hence loading the file during "audit -s" would be useless.

The audit_user file is only read when a user logs in and consequently a new
audit context for that login session is created (e.g., see
usr.bin/login/login_audit.c).  In that case the user's entry is read from
audit_user, and combined with the "always audit" flags specified in the flags
parameter in /etc/audit_control into the user's audit mask.  This mask is part
of the audit context inherited by every process forked from that initial login

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list