[PATCH ghak73 V2] audit: re-structure audit field valid checks

2019-05-08 Thread Richard Guy Briggs
Multiple checks were being done in one switch case statement that started to cause some redundancies and awkward exceptions. Separate the valid field and op check from the select valid values checks. Enforce the elimination of meaningless bitwise and greater/lessthan checks on string fields and o

[PATCH ghak64 V2] audit: add saddr_fam filter field

2019-05-08 Thread Richard Guy Briggs
Provide a method to filter out sockaddr and bind calls by network address family. Existing SOCKADDR records are listed for any network activity. Implement the AUDIT_SADDR_FAM field selector to be able to classify or limit records to specific network address families, such as AF_INET or AF_INET6.

Re: [PATCH ghak64 V2] audit: add saddr_fam filter field

2019-05-08 Thread Paul Moore
On Wed, May 8, 2019 at 12:46 PM Richard Guy Briggs wrote: > > Provide a method to filter out sockaddr and bind calls by network > address family. > > Existing SOCKADDR records are listed for any network activity. > Implement the AUDIT_SADDR_FAM field selector to be able to classify or > limit reco

Re: [PATCH ghak64 V2] audit: add saddr_fam filter field

2019-05-08 Thread Richard Guy Briggs
On 2019-05-08 18:05, Paul Moore wrote: > On Wed, May 8, 2019 at 12:46 PM Richard Guy Briggs wrote: > > > > Provide a method to filter out sockaddr and bind calls by network > > address family. > > > > Existing SOCKADDR records are listed for any network activity. > > Implement the AUDIT_SADDR_FAM