-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
tlog not working when auditd is disabled, and there's no /proc/PID/sessionid #353
Comments
another way is to use systemd $XDG_SESSION_ID, or call 'sd_pid_get_session(my_pid, &session)', which would grab something from systemd, similar to /proc/self/sesionid, whose value would show up in the same position of 'loginctl session-status' output. |
Using a systemd login-related session ID as fallback for the |
At least it would help out those folks working with systemd-enabled Linux hosts where auditd is disabled. |
tlog not working when auditd is disabled, and there's no /proc/self/sessionid. How to ensure tlog would work when auditd is disabled? There's an existing issue here "#264", where it suggested using 'getsid(0)', and it seems to work in Linux, where calling 'getsid(0)' would get the interactive ssh session's BASH pid (if the logged in user using BASH shell), which would stay the same during the whole interactive session.
What's the concern of just using getsid(0) (instead of using /proc/self/sessionid) in case auditd being already disabled? pid reaching PID_MAX and wraps around?
The text was updated successfully, but these errors were encountered: