On 2022-02-22 13:56, Paul Moore wrote: > On Tue, Feb 22, 2022 at 11:45 AM Richard Guy Briggs <[email protected]> wrote: > > AUDIT_TIME_* events are generated when there are syscall rules present > > that are not related to time keeping. This will produce noisy log > > entries that could flood the logs and hide events we really care about. > > > > Rather than immediately produce the AUDIT_TIME_* records, store the data > > in the context and log it at syscall exit time respecting the filter > > rules. > > > > Note: This eats the audit_buffer, unlike any others in show_special(). > > > > Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 > > > > Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment") > > Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments") > > Signed-off-by: Richard Guy Briggs <[email protected]> > > --- > > Changelog: > > v2: > > - rename __audit_ntp_log_ to audit_log_ntp > > - pre-check ntp before storing > > - move tk out of the context union and move ntp logging to the bottom of > > audit_show_special() > > - restructure logging of ntp to use ab and allocate more only if more > > - add Fixes lines > > v3 > > - move tk into union > > - rename audit_log_ntp() to audit_log_time() and add tk > > - key off both AUDIT_TIME_* but favour NTP > > v4 > > - drop tk goto in favour of ntp if clause > > - add comments to clarify calling function buffer expectations > > v5 > > - hold my nose and swallow the audit_buffer in audit_log_time() > > v6 > > - declare audit_log_time() and ntp_name as static > > > > kernel/audit.h | 4 +++ > > kernel/auditsc.c | 85 ++++++++++++++++++++++++++++++++++++------------ > > 2 files changed, 69 insertions(+), 20 deletions(-) > > Merged into audit/next.
Thank you. > paul-moore.com - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
