RFE: AUDIT messages should contain uid/gid for local accesses (to match more or less the si:localuser and si:localgroup auth. methods). Example: Running an Xserver with "-audit 4" results in the following audit messages: -- snip -- AUDIT: Thu Dec 2 23:38:51 2004: 4397 Xprt: client 1 connected from local host AUDIT: Thu Dec 2 23:38:51 2004: 4397 Xprt: client 1 disconnected -- snip -- It would be nice if the "connected from local host" could be extended to something like "connected from local host, uid=23933(intruder) gid=233406(happyhackers)"
uid is interesting, not sure gid is (you can always look that up). Change is easy to do - see patch coming next.
Created attachment 7626 [details] [review] Patch against xserver git head
Committed to git master: commit d676512308b4932fc80de27776420f191545ae75 Author: Alan Coopersmith <alan.coopersmith@sun.com> Date: Wed Nov 1 14:57:04 2006 -0800 Bug #1997: AUDIT messages should contain uid for local accesses <https://bugs.freedesktop.org/show_bug.cgi?id=1997>
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.