Open HarkonenBade opened 6 years ago
For some events openat is missing the ret_objuuid1 field.
{ "event": "audit:event:aue_openat_rwtc:", "time": 1495522861397134836, "pid": 63172, "ppid": 63170, "tid": 100097, "uid": 0, "cpu_id": 1, "exec": "tee", "subjprocuuid": "9491df09-3f85-11e7-8eb5-ab40e21bce37", "subjthruuid": "c56a58fc-371b-11e7-8eb5-ab40e21bce37", "arg_objuuid1": "00000000-0000-0000-0000-000000000000", "upath1": "/dev/stderr", "flags": 1537, "fd": -100, "ret_fd1": 3, "mode": 438, "retval": 3 }
Is this bug present for all instances of aueopenat*, or just specific ones? I notice in particular that this is a path to a device node, which are handled differently than ordinary files in a number of ways.
For some events openat is missing the ret_objuuid1 field.