On Tue, Feb 4, 2020 at 10:47 AM Steve Grubb [off-list ref] wrote:

On Tuesday, February 4, 2020 8:19:44 AM EST Richard Guy Briggs wrote:

quoted

quoted

The established pattern is that we print -1 when its unset and "?" when
its totalling missing. So, how could this be invalid? It should be set
or not. That is unless its totally missing just like when we do not run
with selinux enabled and a context just doesn't exist.

Ok, so in this case it is clearly unset, so should be -1, which will be a
20-digit number when represented as an unsigned long long int.

Thank you for that clarification Steve.

It is literally a  -1.  ( 2 characters)

Well, not as Richard has currently written the code, it is a "%llu".
This was why I asked the question I did; if we want the "-1" here we
probably want to special case that as I don't think we want to display
audit container IDs as signed numbers in general.

-- 
paul moore
www.paul-moore.com