'Re: at, cron: wrong auid'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-audit
Subject:    Re: at, cron: wrong auid
From:       Debora Velarde <dvelarde () us ! ibm ! com>
Date:       2005-07-20 18:47:05
Message-ID: OF617C68A2.E7E4C46C-ON87257044.0066604A-86257044.006730AD () us ! ibm ! com
[Download RAW message or body]

Debora Velarde/Austin/IBM wrote on 07/19/2005 11:16:47 AM:

> Hi All,
>
> We were asked to modify our 'at' and 'crontab' testcases so that the
> job being run contained a syscall.  Then we needed to verify that
> the correct audit record was generated for that syscall.  In doing
> so, I see that the audit record for the syscall executed by the job,
> contains "auid=0", rather than "auid=500" which is the user I
> initially logged in with.
>
> I asked Klaus if this behavior is valid.  His reply, "The syscall
> audit record needs to have the auid of the user on whose
> behalf the job is executing, for example auid=500, *not* 0."
>
> -debbie


My apologies, this was a testcase problem.  auid is fine.

-debbie
[Attachment #3 (text/html)]

<html><body>
<p><tt>Debora Velarde/Austin/IBM wrote on 07/19/2005 11:16:47 AM:<br>
<br>
&gt; Hi All,</tt><br>
<tt>&gt; <br>
&gt; We were asked to modify our 'at' and 'crontab' testcases so that the<br>
&gt; job being run contained a syscall. &nbsp;Then we needed to verify that <br>
&gt; the correct audit record was generated for that syscall. &nbsp;In doing <br>
&gt; so, I see that the audit record for the syscall executed by the job,<br>
&gt; contains &quot;auid=0&quot;, rather than &quot;auid=500&quot; which is the user I <br>
&gt; initially logged in with.</tt><br>
<tt>&gt; <br>
&gt; I asked Klaus if this behavior is valid. &nbsp;His reply, &quot;The syscall <br>
&gt; audit record needs to have the auid of the user on whose<br>
&gt; behalf the job is executing, for example auid=500, *not* 0.&quot;</tt><br>
<tt>&gt; <br>
&gt; -debbie</tt><br>
<br>
<br>
<tt>My apologies, this was a testcase problem. &nbsp;auid is fine.</tt><br>
<br>
<tt>-debbie</tt></body></html>

[prev in list] [next in list] [prev in thread] [next in thread]
Configure | About | News | Add a list | Sponsored by KoreLogic