-
Notifications
You must be signed in to change notification settings - Fork 26
Closed
Description
COS kernels have task_struct that differs from the vanilla one in regards how audit information is stored, loginuid is present in an intermediate structure audit_task_info. This mean regular CO-RE read will not pass verifier on COS kernels. To address it, check the field presence first, before extracting the value. Note, it's important that the condition is formulated this way -- the first branch should be an existing one, otherwise it will be removed as a dead code and no comparison will be made.
Part of #1008
Metadata
Metadata
Assignees
Labels
No labels