On Thu, 19 Oct 2017, Richard Guy Briggs wrote: > On 2017-10-11 20:57, Richard Guy Briggs wrote: > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > application execution (SYSCALL execve). This is not expected as it was > > supposed to be limited to when the file system actually had capabilities > > in an extended attribute. It lists all capabilities making the event > > really ugly to parse what is happening. The PATH record correctly > > records the setuid bit and owner. Suppress the BPRM_FCAPS record on > > set*id. > > <crickets> > > Serge? James? Can one of you two take this via your trees since Paul > has backed down citing (reasonably) that it is mostly capabilities > patches rather than audit?
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general -- James Morris <james.l.mor...@oracle.com> -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
