[Bug 185034] audit(8): audit -s do not sync audit_user

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=185034

Christian Brueffer <brueffer at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |Works As Intended
                 CC|                            |brueffer at FreeBSD.org
             Status|In Progress                 |Closed
           Assignee|freebsd-bugs at FreeBSD.org    |brueffer at FreeBSD.org

--- Comment #1 from Christian Brueffer <brueffer at FreeBSD.org> ---
Hi Radim, the information which flags to audit for a user are not managed by
auditd, hence loading the file during "audit -s" would be useless.

The audit_user file is only read when a user logs in and consequently a new
audit context for that login session is created (e.g., see
usr.bin/login/login_audit.c).  In that case the user's entry is read from
audit_user, and combined with the "always audit" flags specified in the flags
parameter in /etc/audit_control into the user's audit mask.  This mask is part
of the audit context inherited by every process forked from that initial login
process.

-- 
You are receiving this mail because:
You are the assignee for the bug.