cadets / freebsd-old

FreeBSD src tree http://www.FreeBSD.org/
Other
12 stars 7 forks source link

openat missing ret_objuuid1 #95

Open HarkonenBade opened 6 years ago

HarkonenBade commented 6 years ago

For some events openat is missing the ret_objuuid1 field.

{
"event": "audit:event:aue_openat_rwtc:",
"time": 1495522861397134836,
"pid": 63172,
"ppid": 63170,
"tid": 100097,
"uid": 0,
"cpu_id": 1,
"exec": "tee",
"subjprocuuid": "9491df09-3f85-11e7-8eb5-ab40e21bce37",
"subjthruuid": "c56a58fc-371b-11e7-8eb5-ab40e21bce37",
"arg_objuuid1": "00000000-0000-0000-0000-000000000000",
"upath1": "/dev/stderr",
"flags": 1537,
"fd": -100,
"ret_fd1": 3,
"mode": 438,
"retval": 3
}
rwatson commented 6 years ago

Is this bug present for all instances of aueopenat*, or just specific ones? I notice in particular that this is a path to a device node, which are handled differently than ordinary files in a number of ways.