* [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
@ 2018-04-09 23:36 ` Richard Guy Briggs
0 siblings, 0 replies; 6+ messages in thread
From: Richard Guy Briggs @ 2018-04-09 23:36 UTC (permalink / raw)
To: Linux-Audit Mailing List, LKML, SElinux list, Linux Security Module list
Cc: Eric Paris, Paul Moore, Steve Grubb, Richard Guy Briggs
The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
missing information about which LSM was responsible and its completion
status. While this record is only issued on success, the parser expects
the res= field to be present.
Old record:
type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
Delete the redundant dangling keywords, add the lsm= field and the res=
field.
New record:
type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
See: https://github.com/linux-audit/audit-kernel/issues/47
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
security/selinux/selinuxfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 00b21b2..496915a 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
out1:
audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
- "policy loaded auid=%u ses=%u",
+ "auid=%u ses=%u lsm=selinux res=1",
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
out:
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
@ 2018-04-09 23:36 ` Richard Guy Briggs
0 siblings, 0 replies; 6+ messages in thread
From: Richard Guy Briggs @ 2018-04-09 23:36 UTC (permalink / raw)
To: linux-security-module
The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
missing information about which LSM was responsible and its completion
status. While this record is only issued on success, the parser expects
the res= field to be present.
Old record:
type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
Delete the redundant dangling keywords, add the lsm= field and the res=
field.
New record:
type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
See: https://github.com/linux-audit/audit-kernel/issues/47
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
security/selinux/selinuxfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 00b21b2..496915a 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
out1:
audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
- "policy loaded auid=%u ses=%u",
+ "auid=%u ses=%u lsm=selinux res=1",
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
out:
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
2018-04-09 23:36 ` Richard Guy Briggs
@ 2018-04-11 21:11 ` Paul Moore
-1 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2018-04-11 21:11 UTC (permalink / raw)
To: Richard Guy Briggs
Cc: Linux-Audit Mailing List, LKML, SElinux list,
Linux Security Module list, Eric Paris, Steve Grubb
On Mon, Apr 9, 2018 at 7:36 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
> missing information about which LSM was responsible and its completion
> status. While this record is only issued on success, the parser expects
> the res= field to be present.
>
> Old record:
> type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
>
> Delete the redundant dangling keywords, add the lsm= field and the res=
> field.
>
> New record:
> type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
>
> See: https://github.com/linux-audit/audit-kernel/issues/47
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> security/selinux/selinuxfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
> index 00b21b2..496915a 100644
> --- a/security/selinux/selinuxfs.c
> +++ b/security/selinux/selinuxfs.c
> @@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
>
> out1:
> audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
> - "policy loaded auid=%u ses=%u",
> + "auid=%u ses=%u lsm=selinux res=1",
This is another case of NACK on principle, but I think we can make an
exception in this particular case.
Also like the other patch, this will need to wait for the merge window
to close before I can merge it.
> from_kuid(&init_user_ns, audit_get_loginuid(current)),
> audit_get_sessionid(current));
> out:
> --
> 1.8.3.1
>
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
@ 2018-04-11 21:11 ` Paul Moore
0 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2018-04-11 21:11 UTC (permalink / raw)
To: linux-security-module
On Mon, Apr 9, 2018 at 7:36 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
> missing information about which LSM was responsible and its completion
> status. While this record is only issued on success, the parser expects
> the res= field to be present.
>
> Old record:
> type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
>
> Delete the redundant dangling keywords, add the lsm= field and the res=
> field.
>
> New record:
> type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
>
> See: https://github.com/linux-audit/audit-kernel/issues/47
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> security/selinux/selinuxfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
> index 00b21b2..496915a 100644
> --- a/security/selinux/selinuxfs.c
> +++ b/security/selinux/selinuxfs.c
> @@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
>
> out1:
> audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
> - "policy loaded auid=%u ses=%u",
> + "auid=%u ses=%u lsm=selinux res=1",
This is another case of NACK on principle, but I think we can make an
exception in this particular case.
Also like the other patch, this will need to wait for the merge window
to close before I can merge it.
> from_kuid(&init_user_ns, audit_get_loginuid(current)),
> audit_get_sessionid(current));
> out:
> --
> 1.8.3.1
>
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
2018-04-11 21:11 ` Paul Moore
@ 2018-04-17 21:55 ` Paul Moore
-1 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2018-04-17 21:55 UTC (permalink / raw)
To: Richard Guy Briggs
Cc: Linux-Audit Mailing List, LKML, SElinux list,
Linux Security Module list, Eric Paris, Steve Grubb
On Wed, Apr 11, 2018 at 5:11 PM, Paul Moore <paul@paul-moore.com> wrote:
> On Mon, Apr 9, 2018 at 7:36 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
>> The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
>> missing information about which LSM was responsible and its completion
>> status. While this record is only issued on success, the parser expects
>> the res= field to be present.
>>
>> Old record:
>> type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
>>
>> Delete the redundant dangling keywords, add the lsm= field and the res=
>> field.
>>
>> New record:
>> type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/47
>> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
>> ---
>> security/selinux/selinuxfs.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
>> index 00b21b2..496915a 100644
>> --- a/security/selinux/selinuxfs.c
>> +++ b/security/selinux/selinuxfs.c
>> @@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
>>
>> out1:
>> audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
>> - "policy loaded auid=%u ses=%u",
>> + "auid=%u ses=%u lsm=selinux res=1",
>
> This is another case of NACK on principle, but I think we can make an
> exception in this particular case.
>
> Also like the other patch, this will need to wait for the merge window
> to close before I can merge it.
Merged into selinux/next.
>> from_kuid(&init_user_ns, audit_get_loginuid(current)),
>> audit_get_sessionid(current));
>> out:
>> --
>> 1.8.3.1
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record
@ 2018-04-17 21:55 ` Paul Moore
0 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2018-04-17 21:55 UTC (permalink / raw)
To: linux-security-module
On Wed, Apr 11, 2018 at 5:11 PM, Paul Moore <paul@paul-moore.com> wrote:
> On Mon, Apr 9, 2018 at 7:36 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
>> The audit MAC_POLICY_LOAD record had redundant dangling keywords and was
>> missing information about which LSM was responsible and its completion
>> status. While this record is only issued on success, the parser expects
>> the res= field to be present.
>>
>> Old record:
>> type=MAC_POLICY_LOAD msg=audit(1479299795.404:43): policy loaded auid=0 ses=1
>>
>> Delete the redundant dangling keywords, add the lsm= field and the res=
>> field.
>>
>> New record:
>> type=MAC_POLICY_LOAD msg=audit(1523293846.204:894): auid=0 ses=1 lsm=selinux res=1
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/47
>> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
>> ---
>> security/selinux/selinuxfs.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
>> index 00b21b2..496915a 100644
>> --- a/security/selinux/selinuxfs.c
>> +++ b/security/selinux/selinuxfs.c
>> @@ -531,7 +531,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
>>
>> out1:
>> audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
>> - "policy loaded auid=%u ses=%u",
>> + "auid=%u ses=%u lsm=selinux res=1",
>
> This is another case of NACK on principle, but I think we can make an
> exception in this particular case.
>
> Also like the other patch, this will need to wait for the merge window
> to close before I can merge it.
Merged into selinux/next.
>> from_kuid(&init_user_ns, audit_get_loginuid(current)),
>> audit_get_sessionid(current));
>> out:
>> --
>> 1.8.3.1
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-04-17 21:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-09 23:36 [PATCH ghak47 V1] audit: normalize MAC_POLICY_LOAD record Richard Guy Briggs
2018-04-09 23:36 ` Richard Guy Briggs
2018-04-11 21:11 ` Paul Moore
2018-04-11 21:11 ` Paul Moore
2018-04-17 21:55 ` Paul Moore
2018-04-17 21:55 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.