Re: [PATCH 04/14] fixup! audit: convert audit_exe to audit_fsnotify

2014-06-18 Thread Eric Paris
On Tue, 17 Jun 2014 23:09:39 -0400 Richard Guy Briggs r...@redhat.com wrote: Remove unnecessary space. --- kernel/auditfilter.c |1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 30091ce..94b6af1 100644 ---

RE: auditing access to directories with restricted access

2014-06-18 Thread Jonathan.Bird
Hi Eric, I don't know if you saw my post from a couple of weeks back on the audit mailing list but it was mentioned (see below) that you may have made a patch available to address this issue I'm experiencing. Is it possible to get hold of this or understand what the status of this is? Thanks,

Re: [PATCH 13/14] audit: continue fleshing out audit by exe

2014-06-18 Thread Eric Paris
Whew, lot going on in here On Tue, 17 Jun 2014 23:09:48 -0400 Richard Guy Briggs r...@redhat.com wrote: --- include/linux/audit.h |1 + kernel/audit.h |1 + kernel/audit_fsnotify.c | 15 +++ kernel/auditfilter.c| 21 - 4 files

Re: [PATCH 14/14] audit: enable audit_get/put_mark()

2014-06-18 Thread Eric Paris
Aside from the refcounting in the previous patch being bad, which you likely didn't make any better here, I think I'm ok with audit_put_mark/audit_get_mark being exposed and used instead of the fsnotify_* calls being used directly... On Tue, 17 Jun 2014 23:09:49 -0400 Richard Guy Briggs

Re: [PATCH 14/14] audit: enable audit_get/put_mark()

2014-06-18 Thread Richard Guy Briggs
On 14/06/18, Eric Paris wrote: Aside from the refcounting in the previous patch being bad, which you likely didn't make any better here, I think I'm ok with audit_put_mark/audit_get_mark being exposed and used instead of the fsnotify_* calls being used directly... I still need to convince

Re: [Linux-ima-user] [PATCH] audit: fix dangling keywords in integrity ima message output

2014-06-18 Thread Richard Guy Briggs
On 14/06/17, Mimi Zohar wrote: On Mon, 2014-06-16 at 15:52 -0400, Richard Guy Briggs wrote: Replace spaces in op keyword labels in log output since userspace audit tools can't parse orphaned keywords. The patch didn't apply cleanly to linux-integrity/#next. Please take a look at it