Re: [PATCH 1/2] audit: introduce a struct to represent an audit timestamp

From: Paul Moore <paul@paul-moore.com>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: "Ondrej Mosnacek" <omosnace@redhat.com>,
	"Thiébaud Weksteen" <tweek@google.com>,
	selinux@vger.kernel.org,
	"Peter Enderborg" <peter.enderborg@sony.com>,
	linux-security-module@vger.kernel.org, linux-audit@redhat.com,
	"Zdenek Pytela" <zpytela@redhat.com>,
	"Michal Sekletar" <msekleta@redhat.com>
Subject: Re: [PATCH 1/2] audit: introduce a struct to represent an audit timestamp
Date: Mon, 19 Dec 2022 17:24:29 -0500	[thread overview]
Message-ID: <CAHC9VhT8TiEFPBFeRXzE6qCyyXjL4rtQc7=iJ+AqeBkkfgw-mA@mail.gmail.com> (raw)
In-Reply-To: <fae32a51-d422-d3ea-0bee-6223ca2cf902@schaufler-ca.com>

On Mon, Dec 19, 2022 at 1:47 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 12/19/2022 9:54 AM, Ondrej Mosnacek wrote:
> > Join the two fields that comprise an audit timestamp into a common
> > structure. This will be used further in later commits.
>
> Patch 30/39 of my LSM stacking patchset[1] is almost identical to this.
> The only significant difference is the structure name. You use audit_timestamp
> whereas I use audit_stamp. I believe that audit_stamp is more correct and
> more consistent with the code that uses it.
>
> [1] https://lore.kernel.org/lkml/f6b8ac05-6900-f57d-0daf-02d5ae53bc47@schaufler-ca.com/T/#m3205b98b2a6b21a296fb831ed35892f01ead191f

For the record, if "audit_stamp" and "audit_timestamp" are my only two
options I prefer "audit_stamp" simply because it is shorter :)

That said, see my comments on patch 2/2.  While an audit timestamp
struct improvement such as is proposed here and in the LSM stacking
patchset is fine, I'm not in favor of exposing the audit timestamp
outside the audit subsystem.

-- 
paul-moore.com