[Bug 242938] audit(4) records the wrong exit code for execve()

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242938

            Bug ID: 242938
           Summary: audit(4) records the wrong exit code for execve()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: ben at desync.com

It seems that audit is recording an errno of EJUSTRETURN instead of 0 for calls
to execve().  This makes an audit policy with +ex ineffective.

header_ex,301,11,execve(2),0,::1,Sat Dec 28 12:10:13 2019, + 102 msec
exec arg,/usr/libexec/atrun
(...)
return,failure: Unknown error: 201,4294967295

I suspect D13180/r326145, but haven't investigated further.

-- 
You are receiving this mail because:
You are the assignee for the bug.