I am trying to configure the linux kernel. I was confused by Make audit loginuid immutable (AUDIT_LOGINUID_IMMUTABLE) [N/y/?].The help says:+config AUDIT_LOGINUID_IMMUTABLE  +   bool Make audit loginuid immutable  +   depends on AUDIT  +   help  +     The config option toggles if a task setting it's loginuid requires  +     CAP_SYS_AUDITCONTROL or if that task should require no special permissions  +     but should instead only allow setting its loginuid if it was never  +     previously set.  On systems which use systemd or a similar central  +     process to restart login services this should be set to true.  On older  +     systems in which an admin would typically have to directly stop and  +     start processes this should be set to false.  Setting this to true allows  +     one to drop potentially dangerous capabilites from the login tasks,  +     but may not be backwards compatible with older init systems.Is loginuid the same as euid which can be changed so that, that particular process gains more privilege and permissions?If not, then can you explain it in simpler terms? Is it like, starting the process with more privileges like sudo [process] or giving a process more permissions during execution or only people who can execute su (system admins or root) can make use of this setting?
Loginuid, should be allowed to change or not (mutable or not)?
linux;process;linux kernel
The documentation for the pam_loginuid PAM module gives a pretty good hint:The pam_loginuid module sets the loginuid process attribute for the  process that was authenticated. This is necessary for applications to  be correctly audited. This PAM module should only be used for entry  point applications like: login, sshd, gdm, vsftpd, crond and atd.  There are probably other entry point applications besides these. You  should not use it for applications like sudo or su as that defeats the  purpose by changing the loginuid to the account they just switched to.So as the last paragraph mentions, the loginuid attribute could be changed when running sudo or su and that kernel option prevents that.Also, here's the relevant source code (second if) from Linux 3.15:static int audit_set_loginuid_perm(kuid_t loginuid){    /* if we are unset, we don't need privs */    if (!audit_loginuid_set(current))        return 0;    /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/    if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))        return -EPERM;    /* it is set, you need permission */    if (!capable(CAP_AUDIT_CONTROL))        return -EPERM;    /* reject if this is not an unset and we don't allow that */    if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) && uid_valid(loginuid))        return -EPERM;    return 0;}(Sacrilege note: tabs have been replaced with 4 spaces to make the code fit better here.)