On 7/13/2020 6:19 PM, Paul Moore wrote:
> On Mon, Jul 13, 2020 at 9:08 PM Richard Guy Briggs wrote:
>> On 2020-07-13 20:11, Paul Moore wrote:
>>> On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
>>> wrote:
... but it does appear that I could switch to using your
audit_alloc_local().
>>
On Mon, Jul 13, 2020 at 9:08 PM Richard Guy Briggs wrote:
> On 2020-07-13 20:11, Paul Moore wrote:
> > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
> > wrote:
> > > ... but it does appear that I could switch to using your
> > > audit_alloc_local().
> >
> > In my opinion, linking the audit co
On 2020-07-13 20:11, Paul Moore wrote:
> On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
> wrote:
> > ... but it does appear that I could switch to using your
> > audit_alloc_local().
>
> In my opinion, linking the audit container ID and LSM stacking
> patchsets would seem like a very big mista
On Mon, Jul 13, 2020 at 8:28 PM Casey Schaufler wrote:
> On 7/13/2020 5:11 PM, Paul Moore wrote:
> > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
> > wrote:
> >> ... but it does appear that I could switch to using your
> >> audit_alloc_local().
> > In my opinion, linking the audit container
On 7/13/2020 5:11 PM, Paul Moore wrote:
> On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
> wrote:
>> ... but it does appear that I could switch to using your audit_alloc_local().
> In my opinion, linking the audit container ID and LSM stacking
> patchsets would seem like a very big mistake, espe
On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler wrote:
> ... but it does appear that I could switch to using your audit_alloc_local().
In my opinion, linking the audit container ID and LSM stacking
patchsets would seem like a very big mistake, especially since the
consolidation you are describing
On 7/13/2020 1:02 PM, Richard Guy Briggs wrote:
> On 2020-07-13 10:55, Casey Schaufler wrote:
>> On 7/13/2020 10:40 AM, Richard Guy Briggs wrote:
>>> On 2020-07-08 18:49, Paul Moore wrote:
On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
> When there are no rules present, the even
On Monday, July 13, 2020 6:30:51 PM EDT Paul Moore wrote:
> On Mon, Jul 13, 2020 at 1:40 PM Richard Guy Briggs wrote:
> > On 2020-07-08 18:49, Paul Moore wrote:
> > > On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs
wrote:
> > > > When there are no rules present, the event SOCKADDR record is no
On Mon, Jul 13, 2020 at 1:40 PM Richard Guy Briggs wrote:
> On 2020-07-08 18:49, Paul Moore wrote:
> > On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
> > > When there are no rules present, the event SOCKADDR record is not
> > > generated due to audit_dummy_context() generated at syscall
On 2020-07-13 10:55, Casey Schaufler wrote:
> On 7/13/2020 10:40 AM, Richard Guy Briggs wrote:
> > On 2020-07-08 18:49, Paul Moore wrote:
> >> On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
> >>> When there are no rules present, the event SOCKADDR record is not
> >>> generated due to aud
On 7/13/2020 10:40 AM, Richard Guy Briggs wrote:
> On 2020-07-08 18:49, Paul Moore wrote:
>> On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
>>> When there are no rules present, the event SOCKADDR record is not
>>> generated due to audit_dummy_context() generated at syscall entry from
>>>
On 2020-07-08 18:49, Paul Moore wrote:
> On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
> > When there are no rules present, the event SOCKADDR record is not
> > generated due to audit_dummy_context() generated at syscall entry from
> > audit_n_rules. Store this information if there is
On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote:
>
> When there are no rules present, the event SOCKADDR record is not
> generated due to audit_dummy_context() generated at syscall entry from
> audit_n_rules. Store this information if there is a context present to
> store it so that manda
When there are no rules present, the event SOCKADDR record is not
generated due to audit_dummy_context() generated at syscall entry from
audit_n_rules. Store this information if there is a context present to
store it so that mandatory events are more complete (startup, LSMs...).
Please see the up
14 matches
Mail list logo