Re: [PATCH v6] audit: log AUDIT_TIME_* records only from rules

[Richard Guy Briggs <rgb@redhat.com>]

On 2022-02-22 13:56, Paul Moore wrote:
> On Tue, Feb 22, 2022 at 11:45 AM Richard Guy Briggs <rgb@redhat.com> wrote:
> > AUDIT_TIME_* events are generated when there are syscall rules present
> > that are not related to time keeping.  This will produce noisy log
> > entries that could flood the logs and hide events we really care about.
> >
> > Rather than immediately produce the AUDIT_TIME_* records, store the data
> > in the context and log it at syscall exit time respecting the filter
> > rules.
> >
> > Note: This eats the audit_buffer, unlike any others in show_special().
> >
> > Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
> >
> > Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
> > Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> > Changelog:
> > v2:
> > - rename __audit_ntp_log_ to audit_log_ntp
> > - pre-check ntp before storing
> > - move tk out of the context union and move ntp logging to the bottom of audit_show_special()
> > - restructure logging of ntp to use ab and allocate more only if more
> > - add Fixes lines
> > v3
> > - move tk into union
> > - rename audit_log_ntp() to audit_log_time() and add tk
> > - key off both AUDIT_TIME_* but favour NTP
> > v4
> > - drop tk goto in favour of ntp if clause
> > - add comments to clarify calling function buffer expectations
> > v5
> > - hold my nose and swallow the audit_buffer in audit_log_time()
> > v6
> > - declare audit_log_time() and ntp_name as static
> >
> >  kernel/audit.h   |  4 +++
> >  kernel/auditsc.c | 85 ++++++++++++++++++++++++++++++++++++------------
> >  2 files changed, 69 insertions(+), 20 deletions(-)
> 
> Merged into audit/next.

Thank you.

> paul-moore.com

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit