From: Richard Guy Briggs <rgb@redhat.com>
To: Linux Containers List <containers@lists.linux-foundation.org>,
Linux-Audit Mailing List <linux-audit@redhat.com>,
LKML <linux-kernel@vger.kernel.org>
Cc: Richard Guy Briggs <rgb@redhat.com>,
Eric Paris <eparis@parisplace.org>,
mpatel@redhat.com, Neil Horman <nhorman@tuxdriver.com>
Subject: [PATCH ghau51/ghau40 v10 09/11] contid: interpret correctly CONTAINER_ID contid field csv
Date: Mon, 21 Dec 2020 12:12:49 -0500 [thread overview]
Message-ID: <20201221171251.2610890-10-rgb@redhat.com> (raw)
In-Reply-To: <20201221171251.2610890-1-rgb@redhat.com>
The CONTAINER_ID record contid field can contain comma-separated values
when accompanying a NETFILTER_PKT record. Records appeared interpreted
as such:
Wrong:
CONTAINER_ID msg=audit(2019-04-10 13:20:18.746:1690) : contid=777 666,333
Right:
CONTAINER_ID msg=audit(2019-04-10 13:20:18.746:1690) : contid=777,666,333
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
src/ausearch-report.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/ausearch-report.c b/src/ausearch-report.c
index 416c2b13fa6a..754b28af2cb6 100644
--- a/src/ausearch-report.c
+++ b/src/ausearch-report.c
@@ -279,7 +279,7 @@ no_print:
if (str && val && (str < val)) {
// Value side has commas and another field exists
// Known: LABEL_LEVEL_CHANGE banners=none,none
- // Known: ROLL_ASSIGN new-role=r,r
+ // Known: ROLE_ASSIGN new-role=r,r
// Known: any MAC LABEL can potentially have commas
int ftype = auparse_interp_adjust_type(n->type,
name, val);
@@ -293,9 +293,11 @@ no_print:
} else if (str && (val == NULL)) {
// Goes all the way to the end. Done parsing
// Known: MCS context in PATH rec obj=u:r:t:s0:c2,c7
+ // Known: CONTAINER_ID/OP old-/contid can be a comma-separated list
int ftype = auparse_interp_adjust_type(n->type,
name, ptr);
- if (ftype == AUPARSE_TYPE_MAC_LABEL)
+ if (ftype == AUPARSE_TYPE_MAC_LABEL
+ || ftype == AUPARSE_TYPE_CONTID)
str = NULL;
else {
*str++ = 0;
--
2.18.4
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2020-12-21 17:14 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-21 17:12 [PATCH ghau51/ghau40 v10 00/11] add support for audit container identifier Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 01/11] AUDIT_CONTAINER_OP message type basic support Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 02/11] AUDIT_CONTAINER_ID " Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 03/11] auditctl: add support for AUDIT_CONTID filter Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 04/11] add ausearch containerid support Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 05/11] start normalization " Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 06/11] libaudit: add support to get the task audit container identifier Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 07/11] signal_info: only print context if it is available Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 08/11] add support for audit_signal_info2 Richard Guy Briggs
2020-12-21 17:12 ` Richard Guy Briggs [this message]
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 10/11] ausearch: convert contid to comma-sep/carrat-mod cnode/clist Richard Guy Briggs
2020-12-21 17:12 ` [PATCH ghau51/ghau40 v10 11/11] libaudit: add support to get and set capcontid on a task Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201221171251.2610890-10-rgb@redhat.com \
--to=rgb@redhat.com \
--cc=containers@lists.linux-foundation.org \
--cc=eparis@parisplace.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatel@redhat.com \
--cc=nhorman@tuxdriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).