Skip to contentSkip to conversation

DAEMON_END message subj field

DISCUSSION Michael C Thompson 2 participants 2 messages Jul 27, 2006

lore
Share & tools
lore
#0 lore raw

Hey Steve,

In the DAEMON_END message, it seems like the subj context is cut short:

type=DAEMON_END msg=audit(1153997923.281:9429) auditd normal halt, sending auid=0 pid=3218 subj=root:staff_r:staff, auditd pid=3209

vs

type=CONFIG_CHANGE msg=audit(1153997824.379:314): audit_enabled=1 old=1 by auid=0 subj=root:staff_r:staff_t:s0-s15:c0.c255

CONFIG_CHANGE and others include the MLS label, but DAEMON_END does not... is this by design or an oversight?

Thanks,
Mike

#1 lore raw
Quoted 3 lines · Michael C Thompson

Hey Steve,

In the DAEMON_END message, it seems like the subj context is cut short:

Will fix.

Quoted 2 lines

CONFIG_CHANGE and others include the MLS label, but DAEMON_END does not... is this by design or an oversight?

I haven't worked on this. You're testing for things I haven't had a chance to address. :) I'll fix this in next update.

-Steve