From: Ondrej Mosnacek <omosnace@redhat.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: Steve Grubb <sgrubb@redhat.com>,
Miroslav Lichvar <mlichvar@redhat.com>,
Linux-Audit Mailing List <linux-audit@redhat.com>,
Paul Moore <paul@paul-moore.com>,
John Stultz <john.stultz@linaro.org>,
Thomas Gleixner <tglx@linutronix.de>,
Stephen Boyd <sboyd@kernel.org>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH ghak10 v5 1/2] audit: Add functions to log time adjustments
Date: Mon, 17 Sep 2018 14:32:46 +0200 [thread overview]
Message-ID: <CAFqZXNsADjmP--Gy20nkF3NjADpAT+7JAWa2raEhQMGfhoaTvQ@mail.gmail.com> (raw)
In-Reply-To: <20180913151455.yxvtcorxakh7vqrq@madcap2.tricolour.ca>
On Thu, Sep 13, 2018 at 5:19 PM Richard Guy Briggs <rgb@redhat.com> wrote:
> On 2018-09-13 15:59, Ondrej Mosnacek wrote:
> > On Mon, Aug 27, 2018 at 6:38 PM Steve Grubb <sgrubb@redhat.com> wrote:
> > > On Monday, August 27, 2018 5:13:17 AM EDT Ondrej Mosnacek wrote:
> > > > On Mon, Aug 27, 2018 at 9:50 AM Miroslav Lichvar <mlichvar@redhat.com>
> > > wrote:
> > > > > On Fri, Aug 24, 2018 at 02:00:00PM +0200, Ondrej Mosnacek wrote:
> > > > > > This patch adds two auxiliary record types that will be used to
> > > > > > annotate
> > > > > > the adjtimex SYSCALL records with the NTP/timekeeping values that have
> > > > > > been changed.
> > > > >
> > > > > It seems the "adjust" function intentionally logs also calls/modes
> > > > > that don't actually change anything. Can you please explain it a bit
> > > > > in the message?
> > > > >
> > > > > NTP/PTP daemons typically don't read the adjtimex values in a normal
> > > > > operation and overwrite them on each update, even if they don't
> > > > > change. If the audit function checked that oldval != newval, the
> > > > > number of messages would be reduced and it might be easier to follow.
> > > >
> > > > We actually want to log any attempt to change a value, as even an
> > > > intention to set/change something could be a hint that the process is
> > > > trying to do something bad (see discussion at [1]).
> > >
> > > One of the problems is that these applications can flood the logs very
> > > quickly. An attempt to change is not needed unless it fails for permissions
> > > reasons. So, limiting to actual changes is probably a good thing.
> >
> > Well, Richard seemed to "violently" agree with the opposite, so now I
> > don't know which way to go... Paul, you are the official tie-breaker
> > here, which do you prefer?
>
> The circumstances have changed with new information being added. I
> recall violently agreeing several iterations ago with your previous
> assessment, which has also changed with this new information. I'd agree
> with Steve that a flood of information about something that did not
> change value could hide important information.
OK, understood.
> (BTW: The expression "to violoently agree with" is generally used in a
> situation where two parties appear to have been arguing two different
> sides of an issue and then realize they have much more in common than
> initially apparent.)
I see, thanks for the explanation! I didn't know that expression
before, so I think I took it a bit too literally :)
>
> > > -Steve
> > >
> > > > There are valid
> > > > arguments both for and against this choice, but we have to pick one in
> > > > the end... Anyway, I should explain the reasoning in the commit
> > > > message better, right now it just states the fact without explanation
> > > > (in the second patch), thank you for pointing my attention to it.
> > > >
> > > > [1] https://www.redhat.com/archives/linux-audit/2018-July/msg00061.html
> > > >
> > > > --
> > > > Ondrej Mosnacek <omosnace at redhat dot com>
> >
> > Ondrej Mosnacek <omosnace at redhat dot com>
>
> - RGB
>
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635
--
Ondrej Mosnacek <omosnace at redhat dot com>Associate Software
Engineer, Security Technologies
Red Hat, Inc.
next prev parent reply other threads:[~2018-09-17 12:33 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-24 11:59 [PATCH ghak10 v5 0/2] audit: Log modifying adjtimex(2) calls Ondrej Mosnacek
2018-08-24 12:00 ` [PATCH ghak10 v5 1/2] audit: Add functions to log time adjustments Ondrej Mosnacek
2018-08-24 18:33 ` John Stultz
2018-08-27 8:28 ` Ondrej Mosnacek
2018-09-13 15:54 ` Richard Guy Briggs
2018-09-17 12:33 ` Ondrej Mosnacek
2018-08-27 7:50 ` Miroslav Lichvar
2018-08-27 9:13 ` Ondrej Mosnacek
2018-08-27 16:38 ` Steve Grubb
2018-09-13 13:59 ` Ondrej Mosnacek
2018-09-13 15:14 ` Richard Guy Briggs
2018-09-17 12:32 ` Ondrej Mosnacek [this message]
2018-09-14 3:09 ` Paul Moore
2018-09-17 12:33 ` Ondrej Mosnacek
2018-09-14 3:18 ` Paul Moore
2018-09-14 15:16 ` Richard Guy Briggs
2018-09-14 15:34 ` Steve Grubb
2018-09-14 16:24 ` Richard Guy Briggs
2018-09-17 14:36 ` Paul Moore
2018-09-17 12:38 ` Ondrej Mosnacek
2018-09-17 14:20 ` Richard Guy Briggs
2018-09-17 14:50 ` Paul Moore
2018-09-21 11:21 ` Ondrej Mosnacek
2018-09-22 20:42 ` Paul Moore
2018-08-24 12:00 ` [PATCH ghak10 v5 2/2] timekeeping/ntp: Audit clock/NTP params adjustments Ondrej Mosnacek
2018-08-24 19:47 ` Richard Guy Briggs
2018-08-24 20:20 ` John Stultz
2018-08-27 11:35 ` Ondrej Mosnacek
2018-08-27 11:45 ` Miroslav Lichvar
2018-08-27 12:02 ` Ondrej Mosnacek
2018-08-27 21:42 ` Thomas Gleixner
2018-09-13 15:35 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFqZXNsADjmP--Gy20nkF3NjADpAT+7JAWa2raEhQMGfhoaTvQ@mail.gmail.com \
--to=omosnace@redhat.com \
--cc=john.stultz@linaro.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mlichvar@redhat.com \
--cc=paul@paul-moore.com \
--cc=rgb@redhat.com \
--cc=sboyd@kernel.org \
--cc=sgrubb@redhat.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).