From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751185AbeCIAXi (ORCPT ); Thu, 8 Mar 2018 19:23:38 -0500 Received: from mail-lf0-f67.google.com ([209.85.215.67]:33286 "EHLO mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750859AbeCIAXh (ORCPT ); Thu, 8 Mar 2018 19:23:37 -0500 X-Google-Smtp-Source: AG47ELuoolwP2oxrweBkdAh4i/NUWbX7FlXI+5dHs7OAvqGCSXRQPOClkjVIsNVJlDjBgei3CnZh/kCwvMZ8IDlNGSs= MIME-Version: 1.0 X-Originating-IP: [108.20.156.165] In-Reply-To: References: <3a9542b261d93bc4eaecfaf359affbba152cf965.1518603831.git.rgb@redhat.com> <20180215023327.tt2s2pbcrblz5a7u@madcap2.tricolour.ca> From: Paul Moore Date: Thu, 8 Mar 2018 19:23:33 -0500 Message-ID: Subject: Re: [RFC PATCH ghak21 1/4] audit: make ANOM_LINK obey audit_enabled and audit_dummy_context To: Richard Guy Briggs Cc: Linux-Audit Mailing List , LKML , Eric Paris , Steve Grubb , Kees Cook Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Feb 15, 2018 at 5:51 PM, Paul Moore wrote: > On Thu, Feb 15, 2018 at 1:16 AM, Kees Cook wrote: >> On Wed, Feb 14, 2018 at 6:33 PM, Richard Guy Briggs wrote: >>> On 2018-02-14 09:51, Kees Cook wrote: >>>> On Wed, Feb 14, 2018 at 8:18 AM, Richard Guy Briggs wrote: >>>> > Audit link denied events emit disjointed records when audit is disabled. >>>> > No records should be emitted when audit is disabled. >>>> > >>>> > See: https://github.com/linux-audit/audit-kernel/issues/21 >>>> > Signed-off-by: Richard Guy Briggs >>>> > --- >>>> > kernel/audit.c | 3 +++ >>>> > 1 file changed, 3 insertions(+) >>>> > >>>> > diff --git a/kernel/audit.c b/kernel/audit.c >>>> > index 227db99..4c3fd24 100644 >>>> > --- a/kernel/audit.c >>>> > +++ b/kernel/audit.c >>>> > @@ -2261,6 +2261,9 @@ void audit_log_link_denied(const char *operation, const struct path *link) >>>> > struct audit_buffer *ab; >>>> > struct audit_names *name; >>>> > >>>> > + if (!audit_enabled || audit_dummy_context()) >>>> > + return; >>>> > + >>>> > name = kzalloc(sizeof(*name), GFP_NOFS); >>>> > if (!name) >>>> > return; >>>> >>>> Doesn't this means errors here would be silent if audit isn't enabled? >>>> I don't that; sysadmins should see this notification regardless of the >>>> audit state... >>> >>> This is a user error and not a system error, so I would think if system >>> auditing is disabled, they don't care about this kind of error. >> >> It could indicate an attack attempt... > > We get beat up by several folks when we emit audit records with audit > disabled, and they have a very valid point. > > I'm not arguing that the information isn't useful, I'm arguing that if > you are interested in the sort of information that audit provides you > should enable audit. :) FYI, merged into audit/next. -- paul moore www.paul-moore.com