From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6AE3C47086 for ; Mon, 24 May 2021 15:53:54 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 38562613E4 for ; Mon, 24 May 2021 15:53:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 38562613E4 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-329-sih-2pLCP4apD6Wl8u0CoA-1; Mon, 24 May 2021 11:53:49 -0400 X-MC-Unique: sih-2pLCP4apD6Wl8u0CoA-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 56BD0801817; Mon, 24 May 2021 15:53:45 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2825B19C79; Mon, 24 May 2021 15:53:44 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 3DBD055342; Mon, 24 May 2021 15:53:41 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 14OFrdRF031468 for ; Mon, 24 May 2021 11:53:39 -0400 Received: by smtp.corp.redhat.com (Postfix) id 58BFA1134CA5; Mon, 24 May 2021 15:53:39 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 53DE71005B63 for ; Mon, 24 May 2021 15:53:36 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id D6CE48556F4 for ; Mon, 24 May 2021 15:53:36 +0000 (UTC) Received: from sonic317-38.consmr.mail.ne1.yahoo.com (sonic317-38.consmr.mail.ne1.yahoo.com [66.163.184.49]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-162-gugjlNWRN3WmPy6oWJ1JYQ-1; Mon, 24 May 2021 11:53:34 -0400 X-MC-Unique: gugjlNWRN3WmPy6oWJ1JYQ-1 X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1621871613; bh=aLqDloQe74ruRWuhvxGydgpYW0ubg1Pjtj1JVPmycfN=; h=X-Sonic-MF:Subject:To:From:Date:From:Subject; b=rFplRPBWuCTrY3DyMNd+tHS/EqxeGUWgVfpYjsI8Kom3eeZV9hZgHq+D7CXsU9rUjytDSC1staoxOklIopcoufq7l2b0PKCyLGNbwaM4zXUGF8WC/yYwKLOQivzZXP5Jjcgx2QTl7oYaYXflJubO+cocDfV+4muCo8rEnsUc7s6MkHbTTvLxyzeEfJWdruXeYHCQXjdjRaCjFDSjQWX63psZKbAOOKYVz/kJs5xb2Wgd76to000R4sR64HnaQNbrjfw0T1pysfhK2P+HSoLpPWgctyIJOhrjyLc9h2Q4/SX1vAJ2tuVR3sUJdn7yfpLskIF1V6hctP28i2E4kPaIsQ== X-YMail-OSG: 9pPnRJAVM1nmEkm_qM5jz0d9bsCn6P0Bmd1BOFLpJEu79YivwTsHGtugHTYbIQL skMv32FoXD4ulpIYJIAPTGoXEwfpv0p8S12.9DYJV4n5J26i74tOX8oH6kMouxbezWeHhF6RP6fP mhos2WBuCGrSmcUNq1XryE89evRxOFG0xr95ROBk.SLvsyppvsYPmfO_iUGSH6hKSWbcu.sozXqY FwmagLcip6Nq2W8Uznxnow5rHMvdXLXVHXao9tebU.2_H0cQDxNYzTO57cCwqCDjxcKH8swtw9Ns cHQl8aITNOgSUue8wcgtJqLorhVtAhEiv8lRowoocluWOLvHk75UucHRu.y8v3Ue7BspFSQWRhKV xFmP1a2bEklEgPfZ1kZwZaQ88usC3Kt5j_A2hMCJxcNhivnrPMsMXXYjhb5XIb1KstTnn1vWOkqO hFHMvUWgCBB0GS7vlLIT58UC4SmthED9qThHs3Y9m4DXi4FO748IvJZ7RSg6ApThJCjvN7R.SVjD TZmmQB85bm8FXCF0p0f3A0GDppmWRWp16lfeE.tuYeL21_Kr_7T9_oLAF.lmsUaTu9dRqVCUTtht r8lMxzpjYTxn.r1R6iVJTAx40rpSBUjPcqplyWg5BIzanfqa1UbyRyLkV4CUk6zfLeplF6RApJz3 hgODDWqf7.fwcPUhucO3mxuFtOarTAyIw2YzJbHL5cwhIXI0s44xynqLvnwUeZ3aSmxTVXk95vfC EW65asvUANCViTCxIeCCospAN3SZnr0tOjFD7wyygEQr4dRzzPOaq93ejLcjiVvNMS07f7Uhu4OJ tguKWY82CNIp81aQtvbeKsJ_Ozj29E5riOdE3GAW_OELbqk5eiw4w41eqI03zR6X.cUwDhPKDAeT 8jfiucSBbaVPlXk9pakpAFDSlmBllxbDK7FeOEZrvB46hU2OEpq11iM5mOCrvXBCPRmZqkPzGOpL X7KR_1Pus9tjklpYjbYTDmYqMUnhu716UCmfBBwK.Kn4_Tg4yI7oagtD0MjOZDbdc.6usNppfFT5 gxaPtddGcdWthTm7ccyWMnrhCzYBZCh4JdC9xUy9b9NRgFQbKiaOk6krfHZSPH7LzAjCo3cVnauN _YDGhhHTzsjVeHt37zOrQ790O3HI8ALp0cBAwjuzM1jCT1u172Qz_cIkQJwgFuCGVwdwzSzNDjk3 nSFxKAOVjXQmbyMCQyuxz4.8R66DG74FQ9fYB7vpdoRxH7LR5er1lowAJ5LBNzLz6YbDZEogFeSk CmML2NpbDs8lGeQ7gVxBiR5hbMtQfKlIHczHBySUbsqj2kwu.WFiYy1I9.hRGp3JdgsNVJ.DgaVN q1b7AGXOq7RT3WwQ_tELzklR1yrlROJS65QxcMq_2QUOthhT1OaJ4e.PXX_wbcx6suDVTsz6Q6su GBz6A3y35X3NZn5wMY5MKqpPTYNpvby3_6lCQBLOWwQ3T8gYfg.vXn2dwxWJbUGE2ei1V10ekuGx d.W3SYXLv1NSF9uoBN_Q2uXT9RSzNV56a.hbUb.OAcpcY7g6Usux9o3HEnL4Apu8Hlg1rRkG5jcj F1piR9vMa9OmEv1KJtHLX9wjziwkon3hzP70QArvaia6IYgOmLMde5jem.ico7oycNmL7NR8JFN4 .xotDyha6hNU_YmoDYOO9.Jha2S2m6N7lzMoZMF8wk4zjjegI2qWj5j.5M1_CmN15Z8jZBINk_fn QU6mKaq4Snu4DJD4eziWMXb7Gr3F.nTfUNYO.PpFBySO43pB.UOuysnnAV9.b11mt9BJUFiBhtGf MjR_fgjxLnWf7P3tNr4cTyoMXiKt70zyKCUR3FMNvkfbgjFvdT4_mCS0zFsMCQNTbnvq34ipKSo4 Y_X9bpGAO0SuaFc1IaduzmtdP3qxwQINiDOEzrujsD_b3tnJO1DlK1VsqIGWV5aLHFXaFiv3hmCA jaDijpdbSkcUTQRlAWEvxlv5k7MM34TDohGe0cv3l8xTHgRuOtdS3Ev365NByKuqwFoH_O9u8x77 iC1QMNOHRpLQoB9_dhc0F1Dqnp4T42E3beAGdsDnuJGBIWL4XMD29UuXKpuU31iEaWn.LR7LuVrS zp29vEhVc360WvZmgjeRXkirBdtHe0OEm4ZrZdsu2l6WjTU4w24epBAfTXOCE5hBZU.HKrBj1i4U 7GnGlxSzn5dkndm6pF9iMLefAsBub97MIAR6d0Hsa6X_kJMSaizEOzDdV0891T6hUTLyfRdFbLiW PQ6C953R128Cr5kzjzo6puYZ2DbqCV7NVCTnK6N8CkC59b2Jd0_7Nxky8mY1RCq_Yn2nvkAQNpJi GKaubzzTm_er6Yc_ZkI99dPDfcacF30ptqEzMh7XIvrpXc.r.j0MqHA1Uh31_qLzL_cX1SV6ohXt As2wv7rsAnIZP2PQBv3oEJ7hkr_fHnUoj.vbv81NSy6NdEJgi3SOWjuoTak7TurcbOirk0dxxS1L Bri7tooZX2647SnhmGIsrNSNK6QR5hDn8vn1lRLJt7Y_fKUfhkUy5AkCs5bqumJya51YXfPo3dW1 2InjWumB4cWhd4VwvCq26RzO8SyBxYgXXJ7RPt3hZratUR7I- X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic317.consmr.mail.ne1.yahoo.com with HTTP; Mon, 24 May 2021 15:53:33 +0000 Received: by kubenode557.mail-prod1.omega.gq1.yahoo.com (VZM Hermes SMTP Server) with ESMTPA ID 5327c404948618e1b0ba65728c7710aa; Mon, 24 May 2021 15:53:30 +0000 (UTC) Subject: Re: [PATCH v26 22/25] Audit: Add new record for multiple process LSM attributes To: Steve Grubb , linux-audit@redhat.com, John Johansen References: <20210513200807.15910-1-casey@schaufler-ca.com> <2582635.mvXUDI8C0e@x2> From: Casey Schaufler Message-ID: <01af5c96-9e10-80f2-970d-a98cf087f82d@schaufler-ca.com> Date: Mon, 24 May 2021 08:53:30 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.10.2 MIME-Version: 1.0 In-Reply-To: <2582635.mvXUDI8C0e@x2> X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-loop: linux-audit@redhat.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gNS8yMi8yMDIxIDc6MDAgUE0sIFN0ZXZlIEdydWJiIHdyb3RlOgo+IE9uIEZyaWRheSwgTWF5 IDIxLCAyMDIxIDY6MDU6NDEgUE0gRURUIENhc2V5IFNjaGF1ZmxlciB3cm90ZToKPj4+PiBUaGUg cmVjb3JkIGlzIHByb2R1Y2VkIG9ubHkgaW4gY2FzZXMgd2hlcmUgdGhlcmUgaXMgbW9yZSB0aGFu IG9uZQo+Pj4+IHNlY3VyaXR5IG1vZHVsZSB3aXRoIGEgcHJvY2VzcyAiY29udGV4dCIuCj4+Pj4g SW4gY2FzZXMgd2hlcmUgdGhpcyByZWNvcmQgaXMgcHJvZHVjZWQgdGhlIHN1Ymo9IGZpZWxkcyBv Zgo+Pj4+IG90aGVyIHJlY29yZHMgaW4gdGhlIGF1ZGl0IGV2ZW50IHdpbGwgYmUgc2V0IHRvICJz dWJqPT8iLgo+Pj4+Cj4+Pj4gQW4gZXhhbXBsZSBvZiB0aGUgTUFDX1RBU0tfQ09OVEVYVFMgKDE0 MjApIHJlY29yZCBpczoKPj4+Pgo+Pj4+IHR5cGU9VU5LTk9XTlsxNDIwXQo+Pj4+IG1zZz1hdWRp dCgxNjAwODgwOTMxLjgzMjoxMTMpCj4+Pj4gc3Vial9hcHBhcm1vcj09dW5jb25maW5lZAo+Pj4g SXQgc2hvdWxkIGJlIGp1c3QgYSBzaW5nbGUgIj0iIGluIHRoZSBsaW5lIGFib3ZlLgo+PiBBcHBB cm1vciBwcm92aWRlcyB0aGUgMm5kICI9IiBhcyBwYXJ0IG9mIHRoZSBzdWJqZWN0IGNvbnRleHQu Cj4+IFdoYXQncyBoZXJlIGlzIGNvcnJlY3QuIEkgd29uJ3QgYXJndWUgdGhhdCBpdCB3b24ndCBj YXNlIGNvbmZ1c2lvbgo+PiBvciB3b3JzZS4KPiBXZSBoYXZlIGEgc3BlY2lmaWNhdGlvbiBmb3Ig YSB2ZXJ5IGxvbmcgdGltZToKPgo+IGh0dHBzOi8vZ2l0aHViLmNvbS9saW51eC1hdWRpdC9hdWRp dC1kb2N1bWVudGF0aW9uL3dpa2kvU1BFQy1Xcml0aW5nLUdvb2QtRXZlbnRzCj4KPiBFdmVyeW9u ZSBoYXMgdG8gb2JleSBydWxlcyBvciBubyB0b29scyB3b3JrLgoKUmlnaHQuIFdvdWxkIHF1b3Rp bmcgdGhlIHZhbHVlIHN1YmpfYXBwYXJtb3I9Ij11bmNvbmZpbmVkIiBzdWZmaWNlPwpJIHRoaW5r IHRoYXQncyB3aGF0IHRoZSBydWxlYm9vayBzYXlzLCBidXQgSSBsaWtlIHRvIGJlIHN1cmUuCsKg CgotLQpMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKTGludXgtYXVkaXRAcmVkaGF0LmNvbQpodHRw czovL2xpc3RtYW4ucmVkaGF0LmNvbS9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWF1ZGl0