From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86CB5C10F25 for ; Mon, 9 Mar 2020 20:31:29 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id F25F020728 for ; Mon, 9 Mar 2020 20:31:28 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PuQbZMEM" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F25F020728 Authentication-Results: mail.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1583785887; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=1OgHIvqCzmsykVJ9WDCBmfTbi18B33Kpy7ywFAUMyh8=; b=PuQbZMEM/SZnrUygqHvMCF2fZlZz3YTPxT6rJniC90rI8YZQq7jRGxYrDUWBvyXq7GmhhM B2lJkcFO8UQAqUKIB4lX0oNI/B2AT2M1oBPtR8/tQmCOGkjVmqlsNdJQYNr1YvVAli2HwL sMp1RgY/lrCbFu4M4wGDxYQN+jNu2mk= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-420-yStm2Oc_MGSoAUJcx6jmqQ-1; Mon, 09 Mar 2020 16:31:25 -0400 X-MC-Unique: yStm2Oc_MGSoAUJcx6jmqQ-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 77D08107ACC7; Mon, 9 Mar 2020 20:31:21 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 9C48F5C3F8; Mon, 9 Mar 2020 20:31:20 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 3805C18089CD; Mon, 9 Mar 2020 20:31:19 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 029KVHne028823 for ; Mon, 9 Mar 2020 16:31:17 -0400 Received: by smtp.corp.redhat.com (Postfix) id 1ADA25C557; Mon, 9 Mar 2020 20:31:17 +0000 (UTC) Received: from madcap2.tricolour.ca (ovpn-112-16.rdu2.redhat.com [10.10.112.16]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7166A5C28E; Mon, 9 Mar 2020 20:31:10 +0000 (UTC) Date: Mon, 9 Mar 2020 16:31:07 -0400 From: Richard Guy Briggs To: Paul Moore Subject: Re: [PATCH ghak120] audit: trigger accompanying records when no rules present Message-ID: <20200309203107.lzhshn6uzknhmosu@madcap2.tricolour.ca> References: MIME-Version: 1.0 In-Reply-To: User-Agent: NeoMutt/20180716 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-loop: linux-audit@redhat.com Cc: Linux-Audit Mailing List , LKML , Eric Paris X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline On 2020-02-27 20:02, Paul Moore wrote: > On Tue, Feb 18, 2020 at 4:01 PM Richard Guy Briggs wrote: > > > > When there are no audit rules registered, mandatory records (config, > > etc.) are missing their accompanying records (syscall, proctitle, etc.). > > > > This is due to audit context dummy set on syscall entry based on absence > > of rules that signals that no other records are to be printed. > > > > Clear the dummy bit in auditsc_set_stamp() when the first record of an > > event is generated. > > > > Please see upstream github issue > > https://github.com/linux-audit/audit-kernel/issues/120 > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/auditsc.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > index 4effe01ebbe2..31195d122344 100644 > > --- a/kernel/auditsc.c > > +++ b/kernel/auditsc.c > > @@ -2176,6 +2176,8 @@ int auditsc_get_stamp(struct audit_context *ctx, > > t->tv_sec = ctx->ctime.tv_sec; > > t->tv_nsec = ctx->ctime.tv_nsec; > > *serial = ctx->serial; > > + if (ctx->dummy) > > + ctx->dummy = 0; > > Two comments: > > * Why even bother checking to see if ctx->dummy is true? If it is > true you set it to false/0; if it is already false you leave it alone. > Either way ctx->dummy is going to be set to false when you are past > these two lines, might as well just always set ctx->dummy to false/0. Ok, no problem. > * Why are you setting ->dummy to false in auditsc_get_stamp() and not > someplace a bit more obvious like audit_log_start()? Is it because > auditsc_get_stamp() only gets called once per event? I'm willing to > take the "hit" of one extra assignment in audit_log_start() to keep > this in a more obvious place and not buried in auditsc_get_stamp(). It is because the context is only available when syscall logging is enabled (which is on most platforms and hopefully eventually all) and makes for cleaner code and lack of need to check existance of the context. > paul moore - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit