From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C1E84C433F5 for ; Thu, 23 Dec 2021 17:39:24 +0000 (UTC) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-558-rFtYeXHgMU2lCy_mcHa63w-1; Thu, 23 Dec 2021 12:39:22 -0500 X-MC-Unique: rFtYeXHgMU2lCy_mcHa63w-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 7F83B192CC40; Thu, 23 Dec 2021 17:39:19 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id EA9F64BC7F; Thu, 23 Dec 2021 17:39:17 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id A650918095C9; Thu, 23 Dec 2021 17:39:13 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1BNHdBvD007179 for ; Thu, 23 Dec 2021 12:39:11 -0500 Received: by smtp.corp.redhat.com (Postfix) id 1869B53DA; Thu, 23 Dec 2021 17:39:11 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast09.extmail.prod.ext.rdu2.redhat.com [10.11.55.25]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 133E676EE for ; Thu, 23 Dec 2021 17:39:08 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1ED1C2A59560 for ; Thu, 23 Dec 2021 17:39:08 +0000 (UTC) Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-300-g2jcqktAPXehkIrbbCniEw-1; Thu, 23 Dec 2021 12:39:06 -0500 X-MC-Unique: g2jcqktAPXehkIrbbCniEw-1 Received: by mail-ed1-f46.google.com with SMTP id y22so24261745edq.2 for ; Thu, 23 Dec 2021 09:39:06 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kwlDteXEj2DGpTRdVi5eh2K4aGa78IUyoCvQ6+zekkc=; b=peuAVprfjb9DbJnDCwl3SvrmWXtnw+SAuVnASUgPfeug2UjLsY4z1Dddh2/uFQhWNG 7+yhVwPpWI4Dzgo7PD35hcP3xAxfi7BMhsp96SCe8U/COmFO8UF91trGBzIYODvVNbWX 7zribIaVkPKTTJ8iox+0onLaE+0YBua5J+1Q9jjuBP8Y3Tytd9q/LlBwhzO/Z2g8wLgl AQELikOd2kpvQEJhjrAiqoP852LuQpLKxyNNhG0boRvQCPxamal4ryOp2oAev4/vsrvc fr9aVZc384AouaYJ+ZU5KFLSWUploSsBvWQVNBLPsuARciWFlJE5MvX191KE24vinZXQ Whgg== X-Gm-Message-State: AOAM530cbVgVkLKnzGJP1mp2r2x7C/54k+xpgvL+CNS2qnd2ppAZ5FaS +1Tbm30k8hPCT7TpPup4cObxpycF398xyRFQEXtOCjeovA== X-Google-Smtp-Source: ABdhPJzL8DTxdrHbq+4XLkXpP2ufTe3ulSFEHgjOKNvO95JP6TGzkMgkdFLXupU7+l+sjzCgINw6wlWBpWA9QTd+SDQ= X-Received: by 2002:a05:6402:3590:: with SMTP id y16mr2834406edc.343.1640281145069; Thu, 23 Dec 2021 09:39:05 -0800 (PST) MIME-Version: 1.0 References: <20211104215313.GJ1550715@madcap2.tricolour.ca> <20211119180146.GM1550715@madcap2.tricolour.ca> <20211221205012.GX1550715@madcap2.tricolour.ca> In-Reply-To: <20211221205012.GX1550715@madcap2.tricolour.ca> From: Paul Moore Date: Thu, 23 Dec 2021 12:38:54 -0500 Message-ID: Subject: Re: [RFC PATCH v1] audit: log AUDIT_TIME_* records only from rules To: Richard Guy Briggs X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-loop: linux-audit@redhat.com Cc: Eric Paris , Linux-Audit Mailing List X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Tue, Dec 21, 2021 at 3:50 PM Richard Guy Briggs wrote: > On 2021-11-24 10:44, Paul Moore wrote: > > > You mentioned that you wanted to do some more work on this patch so > > I'll hold off further comments until the updated patch is posted. > > I had a look at this patch and there is no further adjustment needed. > The only note is that the AUDIT_TIME_ADJNTPVAL record is printed at the > top of show_special() due to the need to potentially allocate multiple > records. Do you think this requires a comment in the description or > in the code just above the call to __audit_ntp_log_()? > > If not, please merge it at your convenience. Sorry to have dropped this > ball. No worries, I'll put the patch back on the to-review pile. However, since we are at -rc6 this week with the holidays in full swing it seems like this is something that we should defer merging until after the upcoming merge window closes. Now that this is no longer a RFC, I'll try to take a closer look and offer any additional review feedback next week. -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit