>> It doesn't robustly match entries to returns
> Do you mean it fails to match the call/return (annoying), or that it may mismatch them? (pretty bad...)
__audit_syscall_entry() and __audit_syscall_exit() have some interesting checks in them, and I was never convinced that every entry would get paired with the corresponding exit and logged correctly.
>> It doesn't handle containerization sensibly at all.
> Do you mean it's just oblivious to namespaces (but works as far as I know) or something actually not working?
As far as I know, there is one global audit daemon and audit log, and you have to be globally privileged to use it.
> It doesn't robustly match entries to returns
Do you mean it fails to match the call/return (annoying), or that it may mismatch them? (pretty bad...)
> It doesn't handle containerization sensibly at all.
Do you mean it's just oblivious to namespaces (but works as far as I know) or something actually not working?