Quiz: confinement and audit

One correct answer

An audit event has comm="sed", uid=root, auid=unset. What does it say about who changed the file?

• A A user named unset changed the file.
• B The file was changed by sed as root; a service started it, with no person logged in.
• C The event cannot tell which program wrote to the file.