From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Phil Sutter <phil@nwl.cc>
Cc: Richard Guy Briggs <rgb@redhat.com>,
linux-audit@redhat.com, netfilter-devel@vger.kernel.org
Subject: Re: [nf PATCH 2/2] netfilter: nf_tables: Audit log rule reset
Date: Tue, 29 Aug 2023 20:02:55 +0200 [thread overview]
Message-ID: <ZO4yz9ZgrgyzDIWs@calendula> (raw)
In-Reply-To: <20230829175158.20202-2-phil@nwl.cc>
On Tue, Aug 29, 2023 at 07:51:58PM +0200, Phil Sutter wrote:
> Resetting rules' stateful data happens outside of the transaction logic,
> so 'get' and 'dump' handlers have to emit audit log entries themselves.
>
> Cc: Richard Guy Briggs <rgb@redhat.com>
> Fixes: 8daa8fde3fc3f ("netfilter: nf_tables: Introduce NFT_MSG_GETRULE_RESET")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> include/linux/audit.h | 1 +
> kernel/auditsc.c | 1 +
> net/netfilter/nf_tables_api.c | 18 ++++++++++++++++++
> 3 files changed, 20 insertions(+)
>
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 192bf03aacc52..51b1b7054a233 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -118,6 +118,7 @@ enum audit_nfcfgop {
> AUDIT_NFT_OP_FLOWTABLE_REGISTER,
> AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
> AUDIT_NFT_OP_SETELEM_RESET,
> + AUDIT_NFT_OP_RULE_RESET,
> AUDIT_NFT_OP_INVALID,
> };
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 38481e3181975..fc0c7c03eeabe 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -144,6 +144,7 @@ static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
> { AUDIT_NFT_OP_FLOWTABLE_REGISTER, "nft_register_flowtable" },
> { AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, "nft_unregister_flowtable" },
> { AUDIT_NFT_OP_SETELEM_RESET, "nft_reset_setelem" },
> + { AUDIT_NFT_OP_RULE_RESET, "nft_reset_rule" },
> { AUDIT_NFT_OP_INVALID, "nft_invalid" },
> };
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index a1218ea4e0c3d..2aa7b9a55cca4 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -3432,6 +3432,18 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx,
> nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
> }
>
> +static void audit_log_rule_reset(const struct nft_table *table,
> + unsigned int base_seq,
> + unsigned int nentries)
> +{
> + char *buf = kasprintf(GFP_ATOMIC, "%s:%u",
> + table->name, base_seq);
No check for NULL.
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2023-08-29 18:44 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-29 17:51 [nf PATCH 1/2] netfilter: nf_tables: Audit log setelem reset Phil Sutter
2023-08-29 17:51 ` [nf PATCH 2/2] netfilter: nf_tables: Audit log rule reset Phil Sutter
2023-08-29 18:02 ` Pablo Neira Ayuso [this message]
2023-08-30 15:47 ` Pablo Neira Ayuso
2023-08-31 2:27 ` Paul Moore
2023-08-29 18:02 ` [nf PATCH 1/2] netfilter: nf_tables: Audit log setelem reset Pablo Neira Ayuso
2023-08-29 18:38 ` Phil Sutter
2023-08-30 15:46 ` Pablo Neira Ayuso
2023-08-30 20:54 ` Richard Guy Briggs
2023-08-31 2:26 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZO4yz9ZgrgyzDIWs@calendula \
--to=pablo@netfilter.org \
--cc=linux-audit@redhat.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).