[PATCH v2 0/2] audit: add documentation for /proc/PID/stable interfaces

[PATCH v2 0/2] audit: add documentation for /proc/PID/stable interfaces

[Richard Guy Briggs]

Add Documentation/ABI entries for audit interfaces in /proc/PID/ that have
been stable for more than a decade.

Richard Guy Briggs (2):
  audit: document /proc/PID/loginuid
  audit: document /proc/PID/sessionid

 .../ABI/stable/procfs-audit_loginuid          | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 Documentation/ABI/stable/procfs-audit_loginuid

-- 
2.27.0

[PATCH v2 1/2] audit: document /proc/PID/loginuid

[Richard Guy Briggs]

Describe the /proc/PID/loginuid interface in Documentation/ABI/stable that
was added 2005-02-01 by commit 1e2d1492e178 ("[PATCH] audit: handle
loginuid through proc")

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 Documentation/ABI/stable/procfs-audit_loginuid | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 Documentation/ABI/stable/procfs-audit_loginuid

diff --git a/Documentation/ABI/stable/procfs-audit_loginuid b/Documentation/ABI/stable/procfs-audit_loginuid
new file mode 100644
index 000000000000..013bc1d74854
--- /dev/null
+++ b/Documentation/ABI/stable/procfs-audit_loginuid
@@ -0,0 +1,15 @@
+What:		Audit Login UID
+Date:		2005-02-01
+KernelVersion:	2.6.11-rc2 1e2d1492e178 ("[PATCH] audit: handle loginuid through proc")
+Contact:	linux-audit@redhat.com
+Format:		%u (u32)
+Users:		auditd, libaudit, audit-testsuite, login
+Description:
+		The /proc/$pid/loginuid pseudofile is written to set and
+		read to get the audit login UID of process $pid.  If it is
+		unset, permissions are not needed to set it.  The accessor must
+		have CAP_AUDIT_CONTROL in the initial user namespace to write
+		it if it has been set.  It cannot be written again if
+		AUDIT_FEATURE_LOGINUID_IMMUTABLE is enabled.  It cannot be
+		unset if AUDIT_FEATURE_ONLY_UNSET_LOGINUID is enabled.
+
-- 
2.27.0

Re: [PATCH v2 1/2] audit: document /proc/PID/loginuid

[Paul Moore]

On Wed, Mar 17, 2021 at 9:51 PM Richard Guy Briggs <rgb@redhat.com> wrote:
>
> Describe the /proc/PID/loginuid interface in Documentation/ABI/stable that
> was added 2005-02-01 by commit 1e2d1492e178 ("[PATCH] audit: handle
> loginuid through proc")
>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
>  Documentation/ABI/stable/procfs-audit_loginuid | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>  create mode 100644 Documentation/ABI/stable/procfs-audit_loginuid
>
> diff --git a/Documentation/ABI/stable/procfs-audit_loginuid b/Documentation/ABI/stable/procfs-audit_loginuid
> new file mode 100644
> index 000000000000..013bc1d74854
> --- /dev/null
> +++ b/Documentation/ABI/stable/procfs-audit_loginuid
> @@ -0,0 +1,15 @@
> +What:          Audit Login UID
> +Date:          2005-02-01
> +KernelVersion: 2.6.11-rc2 1e2d1492e178 ("[PATCH] audit: handle loginuid through proc")
> +Contact:       linux-audit@redhat.com
> +Format:                %u (u32)

Existing examples seem to just use the printf format specifier, e.g.
"%u", without the explicit type, e.g. "u32", which seems cleanest to
me.  I would suggest changing this to just "Format: %u" to better fit
existing convention.

> +Users:         auditd, libaudit, audit-testsuite, login

I didn't get an opportunity to reply to the previous thread before you
sent this, but I really don't like listing specific userspace
tools/libraries here.  I recognize that you like the specificity, but
I do not, and I fear that it will become invalid over time either due
to deprecation of old packages or omission of new ones; the fact that
we are just now adding an entry from 2005 shows how this area of
Documentation can often be neglected.

Please replace this with something like "audit and login applications"
or something similar.

--
paul moore
www.paul-moore.com

[PATCH v2 2/2] audit: document /proc/PID/sessionid

[Richard Guy Briggs]

Describe the /proc/PID/loginuid interface in Documentation/ABI/stable that
was added 2008-03-13 in commit 1e0bd7550ea9 ("[PATCH] export sessionid
alongside the loginuid in procfs")

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 Documentation/ABI/stable/procfs-audit_loginuid | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Documentation/ABI/stable/procfs-audit_loginuid b/Documentation/ABI/stable/procfs-audit_loginuid
index 013bc1d74854..5d09637a4ae2 100644
--- a/Documentation/ABI/stable/procfs-audit_loginuid
+++ b/Documentation/ABI/stable/procfs-audit_loginuid
@@ -13,3 +13,15 @@ Description:
 		AUDIT_FEATURE_LOGINUID_IMMUTABLE is enabled.  It cannot be
 		unset if AUDIT_FEATURE_ONLY_UNSET_LOGINUID is enabled.
 
+
+What:		Audit Login Session ID
+Date:		2008-03-13
+KernelVersion:	2.6.25-rc7 1e0bd7550ea9 ("[PATCH] export sessionid alongside the loginuid in procfs")
+Contact:	linux-audit@redhat.com
+Format:		%u (u32)
+Users:		auditd, libaudit, audit-testsuite, login
+Description:
+		The /proc/$pid/sessionid pseudofile is read to get the
+		audit login session ID of process $pid.  It is set
+		automatically, serially assigned with each new login.
+
-- 
2.27.0

Re: [PATCH v2 2/2] audit: document /proc/PID/sessionid

[Paul Moore]

On Wed, Mar 17, 2021 at 9:51 PM Richard Guy Briggs <rgb@redhat.com> wrote:
>
> Describe the /proc/PID/loginuid interface in Documentation/ABI/stable that
> was added 2008-03-13 in commit 1e0bd7550ea9 ("[PATCH] export sessionid
> alongside the loginuid in procfs")
>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
>  Documentation/ABI/stable/procfs-audit_loginuid | 12 ++++++++++++
>  1 file changed, 12 insertions(+)

The same comments from patch 1/2 apply here.

> diff --git a/Documentation/ABI/stable/procfs-audit_loginuid b/Documentation/ABI/stable/procfs-audit_loginuid
> index 013bc1d74854..5d09637a4ae2 100644
> --- a/Documentation/ABI/stable/procfs-audit_loginuid
> +++ b/Documentation/ABI/stable/procfs-audit_loginuid
> @@ -13,3 +13,15 @@ Description:
>                 AUDIT_FEATURE_LOGINUID_IMMUTABLE is enabled.  It cannot be
>                 unset if AUDIT_FEATURE_ONLY_UNSET_LOGINUID is enabled.
>
> +
> +What:          Audit Login Session ID
> +Date:          2008-03-13
> +KernelVersion: 2.6.25-rc7 1e0bd7550ea9 ("[PATCH] export sessionid alongside the loginuid in procfs")
> +Contact:       linux-audit@redhat.com
> +Format:                %u (u32)
> +Users:         auditd, libaudit, audit-testsuite, login
> +Description:
> +               The /proc/$pid/sessionid pseudofile is read to get the
> +               audit login session ID of process $pid.  It is set
> +               automatically, serially assigned with each new login.
> +

-- 
paul moore
www.paul-moore.com