Re: [RFC PATCH V2 0/4] capabilities: do not audit log BPRM_FCAPS on set*id

2017-06-02 Thread Paul Moore
On Fri, Jun 2, 2017 at 2:03 PM, Richard Guy Briggs wrote: > On 2017-06-02 11:19, Paul Moore wrote: >> On Thu, May 11, 2017 at 4:42 PM, Richard Guy Briggs wrote: >> > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid >> > application execution (SYSCALL execve). This is not exp

Re: [RFC PATCH V2 0/4] capabilities: do not audit log BPRM_FCAPS on set*id

2017-06-02 Thread Richard Guy Briggs
On 2017-06-02 11:19, Paul Moore wrote: > On Thu, May 11, 2017 at 4:42 PM, Richard Guy Briggs wrote: > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > application execution (SYSCALL execve). This is not expected as it was > > supposed to be limited to when the file syst

Re: [PATCH 6/6 RFC] netfilter: add audit netns ID

2017-06-02 Thread Paul Moore
On Wed, May 24, 2017 at 3:44 PM, Eric W. Biederman wrote: > Richard Guy Briggs writes: > >> On 2017-05-24 19:31, Pablo Neira Ayuso wrote: >>> Cc'ing Eric Biederman. >>> >>> On Thu, May 18, 2017 at 01:21:52PM -0400, Richard Guy Briggs wrote: >>> > diff --git a/net/bridge/netfilter/ebtables.c >>>

Re: [PATCH 5/6 RFC] netfilter: add audit operation field

2017-06-02 Thread Paul Moore
On Thu, May 18, 2017 at 1:21 PM, Richard Guy Briggs wrote: > Add the operation performed (register or replace) to the NETFILTER_CFG and > NETFILTER_CFGSOLO records. > > Here are sample records for accompanied: > type=NETFILTER_CFG msg=audit(1494981627.248:9764): op=replace family=7 > table=brou

Re: [PATCH 4/6 RFC] netfilter: ebtables: audit table registration

2017-06-02 Thread Paul Moore
On Thu, May 18, 2017 at 1:21 PM, Richard Guy Briggs wrote: > Generate audit NETFILTER_CFG records on ebtables table registration. > > Previously this was only being done for all x_tables operations and ebtables > table replacement. > > Audit only when there is an existing syscall audit rule, other

Re: [PATCH 3/6 RFC] netfilter: audit only on xtables and ebtables syscall rule or standalone

2017-06-02 Thread Paul Moore
On Wed, May 24, 2017 at 2:09 PM, Richard Guy Briggs wrote: > On 2017-05-24 19:36, Pablo Neira Ayuso wrote: >> On Thu, May 18, 2017 at 01:21:49PM -0400, Richard Guy Briggs wrote: >> > There were syscall events unsolicited by any audit rule caused by a missing >> > !audit_dummy_context() check befor

Re: [RFC PATCH V2 0/4] capabilities: do not audit log BPRM_FCAPS on set*id

2017-06-02 Thread Paul Moore
On Thu, May 11, 2017 at 4:42 PM, Richard Guy Briggs wrote: > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > application execution (SYSCALL execve). This is not expected as it was > supposed to be limited to when the file system actually had capabilities > in an extended a

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Arnd Bergmann
On Fri, Jun 2, 2017 at 2:18 PM, Yan, Zheng wrote: > On Fri, Jun 2, 2017 at 7:33 PM, Arnd Bergmann wrote: >> On Fri, Jun 2, 2017 at 1:18 PM, Yan, Zheng wrote: >> What I meant is another related problem in ceph_mkdir() where the >> i_ctime field of the parent inode is different between the persist

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Fri, Jun 2, 2017 at 8:57 AM, Deepa Dinamani wrote: > On Thu, Jun 1, 2017 at 5:36 PM, John Stultz wrote: >> On Thu, Jun 1, 2017 at 5:26 PM, Yan, Zheng wrote: >>> On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: On Thu, Jun 1, 2017 at 11:56 AM, Yan, Zheng wrote: > On Sat, Apr 8,

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Arnd Bergmann
On Fri, Jun 2, 2017 at 12:10 PM, Yan, Zheng wrote: > On Fri, Jun 2, 2017 at 5:45 PM, Arnd Bergmann wrote: >> On Fri, Jun 2, 2017 at 4:09 AM, Yan, Zheng wrote: >>> On Fri, Jun 2, 2017 at 8:57 AM, Deepa Dinamani >>> wrote: On Thu, Jun 1, 2017 at 5:36 PM, John Stultz wrote: > On Thu, Ju

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: > On Thu, Jun 1, 2017 at 11:56 AM, Yan, Zheng wrote: >> On Sat, Apr 8, 2017 at 8:57 AM, Deepa Dinamani >> wrote: > >>> diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c >>> index 517838b..77204da 100644 >>> --- a/drivers/block/rbd.c >>>

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Fri, Jun 2, 2017 at 6:51 PM, Arnd Bergmann wrote: > On Fri, Jun 2, 2017 at 12:10 PM, Yan, Zheng wrote: >> On Fri, Jun 2, 2017 at 5:45 PM, Arnd Bergmann wrote: >>> On Fri, Jun 2, 2017 at 4:09 AM, Yan, Zheng wrote: On Fri, Jun 2, 2017 at 8:57 AM, Deepa Dinamani wrote: > On Thu,

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Fri, Jun 2, 2017 at 5:45 PM, Arnd Bergmann wrote: > On Fri, Jun 2, 2017 at 4:09 AM, Yan, Zheng wrote: >> On Fri, Jun 2, 2017 at 8:57 AM, Deepa Dinamani >> wrote: >>> On Thu, Jun 1, 2017 at 5:36 PM, John Stultz wrote: On Thu, Jun 1, 2017 at 5:26 PM, Yan, Zheng wrote: > On Thu, Jun

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Arnd Bergmann
On Fri, Jun 2, 2017 at 1:18 PM, Yan, Zheng wrote: > On Fri, Jun 2, 2017 at 6:51 PM, Arnd Bergmann wrote: >> On Fri, Jun 2, 2017 at 12:10 PM, Yan, Zheng wrote: >>> On Fri, Jun 2, 2017 at 5:45 PM, Arnd Bergmann wrote: On Fri, Jun 2, 2017 at 4:09 AM, Yan, Zheng wrote: > On Fri, Jun 2, 20

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread John Stultz
On Thu, Jun 1, 2017 at 5:26 PM, Yan, Zheng wrote: > On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: >> On Thu, Jun 1, 2017 at 11:56 AM, Yan, Zheng wrote: >>> On Sat, Apr 8, 2017 at 8:57 AM, Deepa Dinamani >>> wrote: >> diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Fri, Jun 2, 2017 at 7:33 PM, Arnd Bergmann wrote: > On Fri, Jun 2, 2017 at 1:18 PM, Yan, Zheng wrote: >> On Fri, Jun 2, 2017 at 6:51 PM, Arnd Bergmann wrote: >>> On Fri, Jun 2, 2017 at 12:10 PM, Yan, Zheng wrote: On Fri, Jun 2, 2017 at 5:45 PM, Arnd Bergmann wrote: > On Fri, Jun 2,

Re: [PATCH 10/12] apparmorfs: Replace CURRENT_TIME with current_time()

2017-06-02 Thread John Johansen
On 04/07/2017 05:57 PM, Deepa Dinamani wrote: > CURRENT_TIME macro is not y2038 safe on 32 bit systems. > > The patch replaces all the uses of CURRENT_TIME by > current_time(). > > This is also in preparation for the patch that transitions > vfs timestamps to use 64 bit time and hence make them >

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Deepa Dinamani
On Thu, Jun 1, 2017 at 5:36 PM, John Stultz wrote: > On Thu, Jun 1, 2017 at 5:26 PM, Yan, Zheng wrote: >> On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: >>> On Thu, Jun 1, 2017 at 11:56 AM, Yan, Zheng wrote: On Sat, Apr 8, 2017 at 8:57 AM, Deepa Dinamani wrote: >>> > diff

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Arnd Bergmann
On Fri, Jun 2, 2017 at 4:09 AM, Yan, Zheng wrote: > On Fri, Jun 2, 2017 at 8:57 AM, Deepa Dinamani wrote: >> On Thu, Jun 1, 2017 at 5:36 PM, John Stultz wrote: >>> On Thu, Jun 1, 2017 at 5:26 PM, Yan, Zheng wrote: On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: > On Thu, Jun 1, 2

Re: [PATCH 04/12] fs: ceph: CURRENT_TIME with ktime_get_real_ts()

2017-06-02 Thread Yan, Zheng
On Thu, Jun 1, 2017 at 6:22 PM, Arnd Bergmann wrote: > On Thu, Jun 1, 2017 at 11:56 AM, Yan, Zheng wrote: >> On Sat, Apr 8, 2017 at 8:57 AM, Deepa Dinamani >> wrote: > >>> diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c >>> index 517838b..77204da 100644 >>> --- a/drivers/block/rbd.c >>>