From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [PATCH V3] audit: normalize NETFILTER_PKT Date: Fri, 3 Mar 2017 08:12:41 -0500 Message-ID: References: <044a666e507a829f8c1d6dcc19ad78cd9f140ddd.1488142060.git.rgb@redhat.com> <20170301162802.GV18258@madcap2.tricolour.ca> <20170301223447.GA18258@madcap2.tricolour.ca> <20170303020007.GF18258@madcap2.tricolour.ca> <20170303115416.GH18258@madcap2.tricolour.ca> <20170303124526.GC29213@breakpoint.cc> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Richard Guy Briggs , Thomas Woerner , linux-audit@redhat.com, Netfilter Developer Mailing List , Thomas Graf To: Florian Westphal Return-path: In-Reply-To: <20170303124526.GC29213@breakpoint.cc> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com List-Id: netfilter-devel.vger.kernel.org On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal wrote: > Richard Guy Briggs wrote: >> > Perhaps I'm missing something here, but let me ask again, how does >> > userspace distinguish between an unset nfmark and a nfmark of >> > 0xffffffff? >> >> It can't. > > It can if you log it as 0, as I asked in patch 1 review. > > (You wouldn't log sk uid of 0 as -1 either, would you?) I want to see the code able to handle the full range of nfmark values as well as the unset case; if that means we need to tweak userspace a bit, please work with Steve on that. -- paul moore www.paul-moore.com