Re: AUDIT_NETFILTER_PKT message format

2017-02-16 Thread Richard Guy Briggs
On 2017-02-16 20:57, Paul Moore wrote: > [NOTE: I'll respond back to the other part of your email later but I'm > running out of time in the day and this was a quick but important > response] > > On Thu, Feb 16, 2017 at 5:36 PM, Richard Guy Briggs wrote: > > Steve has requested the subject attrib

Re: AUDIT_NETFILTER_PKT message format

2017-02-16 Thread Paul Moore
[NOTE: I'll respond back to the other part of your email later but I'm running out of time in the day and this was a quick but important response] On Thu, Feb 16, 2017 at 5:36 PM, Richard Guy Briggs wrote: > Steve has requested the subject attributes which prefixes 7 fields. I already commented

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-16 Thread Kees Cook
On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch set is the third revision of the following two previously >> submitted patch sets: >> >> v1: >> http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical

Re: AUDIT_NETFILTER_PKT message format

2017-02-16 Thread Richard Guy Briggs
On 2017-02-14 16:06, Paul Moore wrote: > On Mon, Feb 13, 2017 at 7:24 PM, Richard Guy Briggs wrote: > > On 2017-02-13 18:50, Paul Moore wrote: > >> On Mon, Feb 13, 2017 at 3:50 PM, Richard Guy Briggs > >> wrote: > > ... > > >> > useless?smac, dmac, macproto > >> > >> Probably useless i

Re: AUDIT_NETFILTER_PKT message format

2017-02-16 Thread Richard Guy Briggs
On 2017-02-15 19:32, Paul Moore wrote: > On Mon, Feb 13, 2017 at 7:24 PM, Richard Guy Briggs wrote: > > On 2017-02-13 18:50, Paul Moore wrote: > >> On Mon, Feb 13, 2017 at 3:50 PM, Richard Guy Briggs > >> wrote: > > ... > > >> > helpful action, hook > >> > >> I haven't checked, but do

Re: [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-16 Thread Tyler Hicks
On 02/16/2017 12:40 PM, Tyler Hicks wrote: > On 02/15/2017 07:10 PM, Kees Cook wrote: >> On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: >>> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >>> index e36dfe9..270a227 100644 >>> --- a/kernel/seccomp.c >>> +++ b/kernel/seccomp.c >>> @@ -509,6 +5

Re: AUDIT_NETFILTER_PKT message format

2017-02-16 Thread Richard Guy Briggs
On 2017-02-14 16:31, Steve Grubb wrote: > On Monday, February 13, 2017 3:50:05 PM EST Richard Guy Briggs wrote: > > > > > > The alternatives that I currently see are to drop packets for which > > > > > > there is no local process ownership, or to leave the ownership > > > > > > fields unset. > > >

Re: [PATCH v3 1/4] seccomp: Add sysctl to display available actions

2017-02-16 Thread Tyler Hicks
On 02/16/2017 01:01 PM, Andy Lutomirski wrote: > On Thu, Feb 16, 2017 at 10:47 AM, Tyler Hicks wrote: >> On 02/15/2017 09:14 PM, Andy Lutomirski wrote: >>> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: This patch creates a read-only sysctl containing an ordered list of seccomp act

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-16 Thread Tyler Hicks
On 02/15/2017 09:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch set is the third revision of the following two previously >> submitted patch sets: >> >> v1: >> http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical.com >> v1

Re: [PATCH v3 1/4] seccomp: Add sysctl to display available actions

2017-02-16 Thread Andy Lutomirski
On Thu, Feb 16, 2017 at 10:47 AM, Tyler Hicks wrote: > On 02/15/2017 09:14 PM, Andy Lutomirski wrote: >> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >>> This patch creates a read-only sysctl containing an ordered list of >>> seccomp actions that the kernel supports. The ordering, from lef

Re: [PATCH v3 1/4] seccomp: Add sysctl to display available actions

2017-02-16 Thread Tyler Hicks
On 02/15/2017 09:14 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch creates a read-only sysctl containing an ordered list of >> seccomp actions that the kernel supports. The ordering, from left to >> right, is the lowest action value (kill) to the hig

Re: [PATCH v3 1/4] seccomp: Add sysctl to display available actions

2017-02-16 Thread Tyler Hicks
On 02/15/2017 07:00 PM, Kees Cook wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch creates a read-only sysctl containing an ordered list of >> seccomp actions that the kernel supports. The ordering, from left to >> right, is the lowest action value (kill) to the highest a

Re: [PATCH v4 4/4] seccomp: Add tests for SECCOMP_RET_LOG

2017-02-16 Thread Tyler Hicks
On 02/15/2017 07:13 PM, Kees Cook wrote: > On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: >> Extend the kernel selftests for seccomp to test the newly added >> SECCOMP_RET_LOG action. The added tests follow the example of existing >> tests. >> >> Unfortunately, the tests are not capable of in

Re: [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-16 Thread Tyler Hicks
On 02/15/2017 07:10 PM, Kees Cook wrote: > On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: >> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >> index e36dfe9..270a227 100644 >> --- a/kernel/seccomp.c >> +++ b/kernel/seccomp.c >> @@ -509,6 +509,22 @@ static void seccomp_send_sigsys(int syscal

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-16 Thread Andy Lutomirski
On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: > This patch set is the third revision of the following two previously > submitted patch sets: > > v1: > http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical.com > v1: > http://lkml.kernel.org/r/1483377999-15019-2-git-se