Richard Guy Briggs

This is due to the range conditions in src/ausearch-lol.c:check_events()

post v1 upstream: https://www.redhat.com/archives/linux-audit/2020-June/msg00061.html

Posted v3 patchset upstream: https://www.redhat.com/archives/linux-audit/2018-June/msg00059.html https://lkml.org/lkml/2018/6/6/626

Posted v4 patchset upstream: https://www.redhat.com/archives/linux-audit/2018-July/msg00189.html https://lkml.org/lkml/2018/7/31/862

Posted v5: https://www.redhat.com/archives/linux-audit/2019-March/msg00036.html https://lkml.org/lkml/2019/3/15/544

post v6: https://www.redhat.com/archives/linux-audit/2019-April/msg00062.html https://lkml.org/lkml/2019/4/9/774

Test case v1 PR: https://github.com/linux-audit/audit-testsuite/pull/83

2019-09-18: post v7: https://www.redhat.com/archives/linux-audit/2019-September/msg00038.html https://lkml.org/lkml/2019/9/18/1138 https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghau40-containerid-filter.v7.0 http://people.redhat.com/~rbriggs/ghak90/git-247fe71

post v8 https://lkml.org/lkml/2019/12/31/244 https://lore.kernel.org/lkml/[email protected]/T/#t https://www.redhat.com/archives/linux-audit/2019-December/msg00066.html latest testsuite pr: https://githu.com/linux-audit/audit-testsuite/pull/91 A repo of the code is here: [email protected]:rgbriggs/audit-userspace.git ghau40-containerid-filter.v8 And test rpms built from it are here: people.redhat.com/~rbriggs/ghak90/git-47ad4ca

Post v9 kernel: https://www.redhat.com/archives/linux-audit/2020-June/msg00108.html https://lkml.org/lkml/2020/6/27/205 Post v9 userspace: https://www.redhat.com/archives/linux-audit/2020-June/msg00122.html