This is a new audit feature which only grants processes with CAP_AUDIT_CONTROL the ability to unset their loginuid. They cannot directly set it from a valid uid to another valid uid. The ability to unset the loginuid is nice because a priviledged task, like that of container creation, can unset the loginuid and then priv is not needed inside the container when a login daemon needs to set the loginuid.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -386,7 +386,8 @@ struct audit_features { · 385 unmodified lines | |||
| 386 | __u32 lock; /* which features to lock */ | 386 | __u32 lock; /* which features to lock */ |
| 387 | }; | 387 | }; |
| 388 | 388 | ||
| 389 | #define AUDIT_LAST_FEATURE -1 | 389 | #define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0 |
| 390 | #define AUDIT_LAST_FEATURE AUDIT_FEATURE_ONLY_UNSET_LOGINUID | ||
| 390 | 391 | ||
| 391 | #define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) | 392 | #define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) |
| 392 | #define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ | 393 | #define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ |