Lennart Poettering
7e02ee98d8
The auditing subsystem is still not virtualized for containers, hence the two values don't really make sense inside them, they will just leak information from outside into the container. Hence don't make use of the data if we detect we are run inside of a container. This has visible effects: logind will no longer try to reuse the auditing session ids as its own session ids when run inside a container. While are at it, modernize the calls in more ways: 1. switch to pidref behaviour, all but one of our uses are using pidref anyway already. 2. use read_virtual_file() + proc_mounted() 3. reasonable distinguish ENOENT errors when reading the process proc files: distinguish the case where /proc is not mounted, from the case where the process is already gone, from where auditing is not enabled in the kernel build.
20 lines
449 B
C
20 lines
449 B
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <sys/types.h>
|
|
|
|
#include "pidref.h"
|
|
|
|
#define AUDIT_SESSION_INVALID UINT32_MAX
|
|
|
|
int audit_session_from_pid(const PidRef *pid, uint32_t *id);
|
|
int audit_loginuid_from_pid(const PidRef *pid, uid_t *uid);
|
|
|
|
bool use_audit(void);
|
|
|
|
static inline bool audit_session_is_valid(uint32_t id) {
|
|
return id > 0 && id != AUDIT_SESSION_INVALID;
|
|
}
|