From: Florian Westphal <fw@strlen.de> To: Richard Guy Briggs <rgb@redhat.com> Cc: Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>, LKML <linux-kernel@vger.kernel.org>, Linux-Audit Mailing List <linux-audit@redhat.com>, netfilter-devel@vger.kernel.org, twoerner@redhat.com, Eric Paris <eparis@parisplace.org>, tgraf@infradead.org Subject: Re: [PATCH ghak124 v3] audit: log nftables configuration change events Date: Thu, 18 Feb 2021 14:41:06 +0100 [thread overview] Message-ID: <20210218134106.GC22944@breakpoint.cc> (raw) In-Reply-To: <20210218132843.GP3141668@madcap2.tricolour.ca> Richard Guy Briggs <rgb@redhat.com> wrote: > Ok, can I get one more clarification on this "hierarchy"? Is it roughly > in the order they appear in nf_tables_commit() after step 3? It appears > it might be mostly already. If it isn't already, would it be reasonable > to re-order them? Would you suggest a different order? For audit purposes I think enum nf_tables_msg_types is already in the most relevant order, the lower numbers being more imporant. So e.g. NEWTABLE would be more interesting than DELRULE, if both are in same batch. > > > such that it would be desirable to filter them out > > > to reduce noise in that single log line if it is attempted to list all > > > the change ops? It almost sounds like it would be better to do one > > > audit log line for each table for each family, and possibly for each op > > > to avoid the need to change userspace. This would already be a > > > significant improvement picking the highest ranking op. > > > > I think i understand what you'd like to do. Yes, that would reduce > > the log output a lot. > > Would the generation change id be useful outside the kernel? Yes, we already announce it to interested parties via nfnetlink. > What > exactly does it look like? Its just a u64 counter that gets incremented whenever there is a change. > I don't quite understand the genmask purpose. Thats an implementation detail only. When we process a transaction, changes to the ruleset are being made but they should not have any effect until the entire transaction is processed. So there are two 'generations' at any time: 1. The active ruleset 2. The future ruleset 2) is what is being changed/modified. When the transaction completes, then the future ruleset becomes the active ruleset. If the transaction has to be aborted, the pending changes are reverted and the genid/genmasks are not changed.
WARNING: multiple messages have this Message-ID (diff)
From: Florian Westphal <fw@strlen.de> To: Richard Guy Briggs <rgb@redhat.com> Cc: Phil Sutter <phil@nwl.cc>, Florian Westphal <fw@strlen.de>, LKML <linux-kernel@vger.kernel.org>, Linux-Audit Mailing List <linux-audit@redhat.com>, netfilter-devel@vger.kernel.org, twoerner@redhat.com, Eric Paris <eparis@parisplace.org>, tgraf@infradead.org Subject: Re: [PATCH ghak124 v3] audit: log nftables configuration change events Date: Thu, 18 Feb 2021 14:41:06 +0100 [thread overview] Message-ID: <20210218134106.GC22944@breakpoint.cc> (raw) In-Reply-To: <20210218132843.GP3141668@madcap2.tricolour.ca> Richard Guy Briggs <rgb@redhat.com> wrote: > Ok, can I get one more clarification on this "hierarchy"? Is it roughly > in the order they appear in nf_tables_commit() after step 3? It appears > it might be mostly already. If it isn't already, would it be reasonable > to re-order them? Would you suggest a different order? For audit purposes I think enum nf_tables_msg_types is already in the most relevant order, the lower numbers being more imporant. So e.g. NEWTABLE would be more interesting than DELRULE, if both are in same batch. > > > such that it would be desirable to filter them out > > > to reduce noise in that single log line if it is attempted to list all > > > the change ops? It almost sounds like it would be better to do one > > > audit log line for each table for each family, and possibly for each op > > > to avoid the need to change userspace. This would already be a > > > significant improvement picking the highest ranking op. > > > > I think i understand what you'd like to do. Yes, that would reduce > > the log output a lot. > > Would the generation change id be useful outside the kernel? Yes, we already announce it to interested parties via nfnetlink. > What > exactly does it look like? Its just a u64 counter that gets incremented whenever there is a change. > I don't quite understand the genmask purpose. Thats an implementation detail only. When we process a transaction, changes to the ruleset are being made but they should not have any effect until the entire transaction is processed. So there are two 'generations' at any time: 1. The active ruleset 2. The future ruleset 2) is what is being changed/modified. When the transaction completes, then the future ruleset becomes the active ruleset. If the transaction has to be aborted, the pending changes are reverted and the genid/genmasks are not changed. -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2021-02-18 16:26 UTC|newest] Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-04 13:20 [PATCH ghak124 v3] audit: log nftables configuration change events Richard Guy Briggs 2020-06-04 13:20 ` Richard Guy Briggs 2020-06-04 17:03 ` Steve Grubb 2020-06-04 17:03 ` Steve Grubb 2020-06-04 17:57 ` Richard Guy Briggs 2020-06-04 17:57 ` Richard Guy Briggs 2020-06-04 18:51 ` Steve Grubb 2020-06-04 18:51 ` Steve Grubb 2020-06-24 0:34 ` Paul Moore 2020-06-24 0:34 ` Paul Moore 2020-06-24 10:03 ` Pablo Neira Ayuso 2020-06-24 10:03 ` Pablo Neira Ayuso 2020-06-24 12:34 ` Richard Guy Briggs 2020-06-24 12:34 ` Richard Guy Briggs 2020-06-24 13:03 ` Pablo Neira Ayuso 2020-06-24 13:03 ` Pablo Neira Ayuso 2020-06-24 13:26 ` Richard Guy Briggs 2020-06-24 13:26 ` Richard Guy Briggs 2021-02-11 15:16 ` Phil Sutter 2021-02-11 16:29 ` Paul Moore 2021-02-11 16:29 ` Paul Moore 2021-02-11 20:26 ` Richard Guy Briggs 2021-02-11 20:26 ` Richard Guy Briggs 2021-02-11 22:09 ` Florian Westphal 2021-02-17 23:41 ` Richard Guy Briggs 2021-02-17 23:41 ` Richard Guy Briggs 2021-02-18 8:22 ` Florian Westphal 2021-02-18 8:22 ` Florian Westphal 2021-02-18 12:42 ` Richard Guy Briggs 2021-02-18 12:42 ` Richard Guy Briggs 2021-02-18 12:52 ` Florian Westphal 2021-02-18 12:52 ` Florian Westphal 2021-02-18 13:28 ` Richard Guy Briggs 2021-02-18 13:28 ` Richard Guy Briggs 2021-02-18 13:41 ` Florian Westphal [this message] 2021-02-18 13:41 ` Florian Westphal 2021-02-18 21:20 ` Richard Guy Briggs 2021-02-18 21:20 ` Richard Guy Briggs 2021-02-18 22:42 ` Florian Westphal 2021-02-18 22:42 ` Florian Westphal 2021-02-19 6:26 ` Richard Guy Briggs 2021-02-19 6:26 ` Richard Guy Briggs 2021-02-19 19:25 ` Richard Guy Briggs 2021-02-19 19:25 ` Richard Guy Briggs 2021-02-12 20:48 ` Richard Guy Briggs 2021-02-12 20:48 ` Richard Guy Briggs 2021-02-11 21:02 ` Steve Grubb 2021-02-11 21:02 ` Steve Grubb 2021-02-12 12:11 ` Phil Sutter 2021-02-12 20:54 ` Richard Guy Briggs 2021-02-12 20:54 ` Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210218134106.GC22944@breakpoint.cc \ --to=fw@strlen.de \ --cc=eparis@parisplace.org \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=phil@nwl.cc \ --cc=rgb@redhat.com \ --cc=tgraf@infradead.org \ --cc=twoerner@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.