From: Paul Moore <paul@paul-moore.com>
To: linux-audit@redhat.com, "sgrubb@redhat.com" <sgrubb@redhat.com>
Subject: Re: audit userspace problems with io_uring async ops
Date: Mon, 6 Mar 2023 15:07:37 -0500 [thread overview]
Message-ID: <CAHC9VhRUGKcJrOh4G_aUk3B9xZxZfjwZYDDsDfvF3pcxAjp_uA@mail.gmail.com> (raw)
In-Reply-To: <CAHC9VhRMJq1gJPoR79AxM1JphmGtxhGMYBkd=Ptuaq3WBjX2Bw@mail.gmail.com>
On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul@paul-moore.com> wrote:
>
> Hi all,
>
> We just recently started picking up audit-testsuite failures with the
> latest upstream kernels and I tracked it down to a change in how the
> IORING_OP_OPENAT operation is handled, and how Steve's audit userspace
> displays async io_uring ops. It appears that when ausearch is used to
> look for events it doesn't display async io_uring events (URINGOP
> records/events without an associated SYSCALL record/event). Take the
> following snippet from /var/log/audit/audit.log ...
Hi Steve,
Before I start working around this in the audit-testsuite I just
wanted to check and see if you already had a fix for ausearch?
--
paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2023-03-06 20:08 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-28 22:04 audit userspace problems with io_uring async ops Paul Moore
2023-03-06 20:07 ` Paul Moore [this message]
2023-03-06 20:58 ` Steve Grubb
2023-03-06 23:12 ` Paul Moore
2023-03-07 21:17 ` Steve Grubb
2023-03-07 22:54 ` Paul Moore
2023-03-17 20:37 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhRUGKcJrOh4G_aUk3B9xZxZfjwZYDDsDfvF3pcxAjp_uA@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=linux-audit@redhat.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.