On Tuesday, February 4, 2020 10:52:36 AM EST Paul Moore wrote:

On Tue, Feb 4, 2020 at 10:47 AM Steve Grubb [off-list ref] wrote:

quoted

On Tuesday, February 4, 2020 8:19:44 AM EST Richard Guy Briggs wrote:

quoted

quoted

The established pattern is that we print -1 when its unset and "?"
when
its totalling missing. So, how could this be invalid? It should be
set
or not. That is unless its totally missing just like when we do not
run
with selinux enabled and a context just doesn't exist.

Ok, so in this case it is clearly unset, so should be -1, which will be
a
20-digit number when represented as an unsigned long long int.

Thank you for that clarification Steve.

It is literally a  -1.  ( 2 characters)

Well, not as Richard has currently written the code, it is a "%llu".
This was why I asked the question I did; if we want the "-1" here we
probably want to special case that as I don't think we want to display
audit container IDs as signed numbers in general.

OK, then go with the long number, we'll fix it in the interpretation. I guess 
we do the same thing for auid.

-Steve