On Wed, 2007-09-26 at 14:30 +0100, David Howells wrote:
(cc'd linux-audit)
As you say, I don't think AUDIT_OBJ_* has anything to do with tasks,
just object labels (like inode labels).
I think you likely want the actor SID / subject SID or whatever you want
to call it for AUDIT_SUBJ_*.
--
Stephen Smalley
National Security Agency
-