search

linux-audit / audit-kernel

GitHub mirror of the Linux Kernel's audit repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Other
137 stars 36 forks source link

RFE: clone3() syscall needs a dedicated record #151

Open stevegrubb opened 11 months ago

stevegrubb commented 11 months ago

The clone3 syscall moves most parameters to struct clone_args. Flags, pidfd, exit_signal, and cgroup are of interest. The pidfd is only of interest if it has been resolved to the fd number - we do not want it's address.