I'm trying to debug why my docker socket changes ownership on a weekly basis.I created an audit log rule on /var/run/docker.sock.The audit report shows me many events happening to that socket, but it is notshowing me which process triggered each event. Instead it prints a '?' in the 'exe' field. Why would this be?Here's some truncated output:    Key Report===============================================# date time key success exe auid event===============================================1. 03/04/17 06:54:09 docker-sock-attributes yes ? -1 1084492. 03/04/17 06:54:09 docker-sock-attributes yes ? -1 1084503. 03/04/17 06:54:10 docker-sock-attributes yes ? -1 108453
Why does this `aureport` show a question mark in the 'exe' field?
security;audit;linux audit