[RFC PATCH V1 11/12] debug audit: add container id

From: Richard Guy Briggs
Date: Thu Mar 01 2018 - 14:48:12 EST


Switch from the 1000 range to the 1300 range for the prototype until it
can be worked out why the former aren't showing up in the logs.
---
include/uapi/linux/audit.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 8443a8f..c392b3b 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -71,7 +71,8 @@
#define AUDIT_TTY_SET 1017 /* Set TTY auditing status */
#define AUDIT_SET_FEATURE 1018 /* Turn an audit feature on or off */
#define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */
-#define AUDIT_CONTAINER 1020 /* Define the container id and information */
+//#define AUDIT_CONTAINER 1020 /* Define the container id and information */
+#define AUDIT_CONTAINER 1333 /* Define the container id and information */

#define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */
#define AUDIT_USER_AVC 1107 /* We filter this differently */
--
1.8.3.1