Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Paul Moore
On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann wrote: > On 12/9/19 3:56 PM, Paul Moore wrote: > > On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: > >> On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > >>> From: Daniel Borkmann > >>> > >>> Allow for audit messages to be emitted u

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Daniel Borkmann
On 12/9/19 3:56 PM, Paul Moore wrote: On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: From: Daniel Borkmann Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itsel

Re: [RFC PATCH v2] security, lockdown, selinux: implement SELinux lockdown

2019-12-09 Thread Paul Moore
On Wed, Nov 27, 2019 at 12:04 PM Stephen Smalley wrote: > Implement a SELinux hook for lockdown. If the lockdown module is also > enabled, then a denial by the lockdown module will take precedence over > SELinux, so SELinux can only further restrict lockdown decisions. > The SELinux hook only dis

Re: [PATCH v3] kernel: audit.c: Add __rcu annotation to RCU pointer

2019-12-09 Thread Paul Moore
On Mon, Dec 2, 2019 at 6:35 PM Joel Fernandes wrote: > On Mon, Dec 02, 2019 at 06:24:29PM -0500, Paul Moore wrote: > > On Mon, Dec 2, 2019 at 4:19 PM Joel Fernandes > > wrote: > > > Good idea to CC the following on RCU patches: > > > Paul McKenney > > > Steven Rostedt > > > (Any others on the RC

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Daniel Borkmann
On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > From: Daniel Borkmann > > Allow for audit messages to be emitted upon BPF program load and > unload for having a timeline of events. The load itself is in > syscall context, so additional info about the process initiating > the BPF prog

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Paul Moore
On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: > On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > > From: Daniel Borkmann > > > > Allow for audit messages to be emitted upon BPF program load and > > unload for having a timeline of events. The load itself is in > > syscall conte