audit-uid v.s. uid, ruid
Can anyone please explain what is the difference between audit-uid, uid and ruid in a audit record? My understanding is uid and ruid can be different for a setuid process. Is this right? If yes, then what does audit-uid means? if not could you please correct me?
Below is a sample audit record, could anyone please interpret what is the event happened?
<record version="2" event="fcntl(2)" host="sbtorsvr291" iso8601="2012-02-06 14:52:15.696 -05:00"><argument arg-num="2" value="0x1" desc="cmd"/><path>/tmp/croutQDLwetW8d</path><attribute mode="100600" uid="bar" gid="bar" fsid="321" nodeid="196416907" device="18446744073709551615"/><subject audit-uid="foo" uid="bar" gid="bar" ruid="bar" rgid="bar" pid="8114" sid="3848589355" tid="13303 131094 sunserver12"/><return errval="success" retval="0"/></record>