test-queue fails on s390x Alpine Linux

2018-04-19 Thread Natanael Copa
Hi, Running the testsuite on Alpine Linux s390x fails: == audit 2.8.3: audisp/plugins/remote/test-suite.log === # TOTAL: 1 # PASS: 0 # SKIP: 0 # XFAIL: 0 # FAIL: 1 # XPASS: 0 # ERROR: 0

Re: [RFC PATCH ghak32 V2 04/13] audit: add containerid filtering

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 20:24, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Implement container ID filtering using the AUDIT_CONTAINERID field name > > to send an 8-character string representing a u64 since the value field > > is only u32. > > > > Sending it as two u32

Re: [RFC PATCH ghak32 V2 09/13] audit: add containerid support for config/feature/user records

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 21:27, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Add container ID auxiliary records to configuration change, feature set > > change > > and user generated standalone records. > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/audi

Re: [RFC PATCH ghak32 V2 07/13] audit: add container aux record to watch/tree/mark

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 20:42, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Add container ID auxiliary record to mark, watch and tree rule > > configuration standalone records. > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/audit_fsnotify.c | 5 - >

Re: [RFC PATCH ghak32 V2 12/13] audit: NETFILTER_PKT: record each container ID associated with a netNS

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 22:10, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Add container ID auxiliary record(s) to NETFILTER_PKT event standalone > > records. Iterate through all potential container IDs associated with a > > network namespace. > > > > Signed-off-by: R

Re: [RFC PATCH ghak32 V2 09/13] audit: add containerid support for config/feature/user records

2018-04-19 Thread Paul Moore
On Thu, Apr 19, 2018 at 8:31 AM, Richard Guy Briggs wrote: > On 2018-04-18 21:27, Paul Moore wrote: >> On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: >> > Add container ID auxiliary records to configuration change, feature set >> > change >> > and user generated standalone records. >

Re: [RFC PATCH ghak32 V2 12/13] audit: NETFILTER_PKT: record each container ID associated with a netNS

2018-04-19 Thread Paul Moore
On Thu, Apr 19, 2018 at 8:45 AM, Richard Guy Briggs wrote: > On 2018-04-18 22:10, Paul Moore wrote: >> On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: >> > Add container ID auxiliary record(s) to NETFILTER_PKT event standalone >> > records. Iterate through all potential container IDs

Re: auditing automounted filesystems (NFS)

2018-04-19 Thread Frank Thommen
Hi, On 04/09/2018 07:45 PM, Frank Thommen wrote: On 04/07/2018 06:38 PM, Frank Thommen wrote: On 07/04/18 13:56, Richard Guy Briggs wrote: On 2018-04-07 04:04, Frank Thommen wrote: Hello, we have started auditing on our systems (file open, close, write etc.). This is no problem on local and

Re: test-queue fails on s390x Alpine Linux

2018-04-19 Thread Steve Grubb
On Thursday, April 19, 2018 7:44:26 AM EDT Natanael Copa wrote: > Hi, > > Running the testsuite on Alpine Linux s390x fails: > > == >audit 2.8.3: audisp/plugins/remote/test-suite.log > ===

Re: auditing automounted filesystems (NFS)

2018-04-19 Thread Steve Grubb
On Thursday, April 19, 2018 9:21:19 AM EDT Frank Thommen wrote: > Hi, > > On 04/09/2018 07:45 PM, Frank Thommen wrote: > > On 04/07/2018 06:38 PM, Frank Thommen wrote: > >> On 07/04/18 13:56, Richard Guy Briggs wrote: > >>> On 2018-04-07 04:04, Frank Thommen wrote: > Hello, > > we

Re: [RFC PATCH ghak32 V2 10/13] audit: add containerid support for seccomp and anom_abend records

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 21:31, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Add container ID auxiliary records to secure computing and abnormal end > > standalone records. > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/auditsc.c | 10 -- > > 1 fi

Re: [RFC PATCH ghak32 V2 05/13] audit: add containerid support for ptrace and signals

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 20:32, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Add container ID support to ptrace and signals. In particular, the "op" > > field provides a way to label the auxiliary record to which it is > > associated. > > > > Signed-off-by: Richard Guy

Re: [RFC PATCH ghak32 V2 06/13] audit: add support for non-syscall auxiliary records

2018-04-19 Thread Richard Guy Briggs
On 2018-04-18 20:39, Paul Moore wrote: > On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > > Standalone audit records have the timestamp and serial number generated > > on the fly and as such are unique, making them standalone. This new > > function audit_alloc_local() generates a loca