audit logging & log callback for avc

[Steve G <linux_4ever@xxxxxxxxx>]

Hello,

I have run across a problem as perhaps the only user of the log callback for
avcs. I want to get the correct uid & loginuid of the user receiving the MAC
denial in the message. For example, in dbus, you could get this message:

Oct 6 20:47:39 devsvr01 dbus: Can't send to audit system: USER_AVC
pid=2426 uid=81 loginuid=-1 message=avc: denied { send_msg } for
scontext=root:system_r:unconfined_t tcontext=user_u:system_r:initrc_t
tclass=dbus

loginuid is unset since dbus is a daemon started by init & uid is the dbus
daemon's uid. The log callback function signature is:

void log_callback (const char *fmt, ...);

So, either the callback needs to have the parameters passed for auid & uid or the
message being generated needs to include this info.

Which way is the best to handle this scenario?

Thanks,
-Steve Grubb


	
		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.