[Bug 296575] Audit records for cron and system-scheduled jobs carry unset audit ID (auid = -1) instead of the job owner for FreeBSD 14.3

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296575

            Bug ID: 296575
           Summary: Audit records for cron and system-scheduled jobs carry
                    unset audit ID (auid = -1) instead of the job owner
                    for FreeBSD 14.3
           Product: Base System
           Version: 14.4-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

Summary
-------
On FreeBSD, audit (BSM) records generated by processes started outside of an
interactive login session — specifically cron jobs and other scheduled/system
tasks — are recorded with an unset audit user ID (auid = -1 / 4294967295).

Because these events carry no attributable audit ID, downstream tooling that
consumes the audit trail cannot map the event to the actual user that owns or
runs the job (for example, root for a root crontab entry). The event is instead
reported as an unattributed/unknown user.

By contrast, processes started through a login path (login(1), sshd, su, etc.)
correctly receive an auid via the audit session setup, so their subsequent
activity is properly attributed.

Environment
-----------
FreeBSD 14.3 (amd64)
auditd enabled, audit trails under /var/audit

Observed Behavior
-----------------
- A command executed via cron (e.g., a root crontab job) generates audit
  records where the subject auid is unset (-1).
- The same command executed in an interactive/login session is correctly
  stamped with the login user's auid.
- As a result, cron/scheduled activity cannot be attributed to the owning
  user in the audit trail.

Expected Behavior
-----------------
Audit records for cron/scheduled jobs should be attributable to the user the
job runs as (the effective/real user), rather than carrying an unset auid.
This would allow scheduled activity to be correctly attributed in the audit
trail, consistent with how login-initiated sessions are handled.

Steps to Reproduce
------------------
1. Enable auditing with an audit_control flags mask that captures process
   execution (e.g., include ex/pc classes) plus the matching naflags.
2. Add a root crontab entry that runs a simple command
   (e.g., /usr/bin/id or /usr/bin/touch /tmp/crontest).
3. Let the cron job run.
4. Inspect the resulting audit records with praudit/auditreduce.
5. Observe that the subject auid for the cron-executed process is -1 (unset),
   whereas the same command run interactively is stamped with the login auid.

Impact
------
Scheduled/cron activity cannot be attributed to a specific user in the audit
trail. In compliance and security review contexts this produces a significant
volume of unattributed events, which are difficult to distinguish from genuine
unattributed activity and lead to false positives during user-attribution
review.

Question / Request
-----------------
Is it possible for cron (and comparable system schedulers) to establish an
audit session (e.g., via setaudit_addr) so that scheduled jobs are attributed
to the job owner, similar to login sessions? Alternatively, guidance on the
intended/recommended way to attribute scheduled-job audit events to the
executing user would be appreciated.

Note: filing this bug for FreeBSD 14.3 but 14.3 is not present in version so
14.4 is selected there

-- 
You are receiving this mail because:
You are the assignee for the bug.