Re: [RFC PATCH v2 0/9] Add LSM access controls and auditing to io_uring

2021-08-24 Thread Richard Guy Briggs
On 2021-08-24 18:27, Paul Moore wrote: > On Tue, Aug 24, 2021 at 4:57 PM Richard Guy Briggs wrote: > > Thanks for the tests. I have a bunch of userspace patches to add to the > > last set I posted and these tests will help exercise them. I also have > > one more kernel patch to post... I'll div

Re: [RFC PATCH 2/9] audit, io_uring, io-wq: add some basic audit support to io_uring

2021-08-24 Thread Richard Guy Briggs
On 2021-06-02 13:46, Paul Moore wrote: > On Wed, Jun 2, 2021 at 1:29 PM Richard Guy Briggs wrote: > > On 2021-05-21 17:49, Paul Moore wrote: > > > WARNING - This is a work in progress and should not be merged > > > anywhere important. It is almost surely not complete, and while it > > > probably

Re: [PATCH v2 RESEND] powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC

2021-08-24 Thread Paul Moore
On Tue, Aug 24, 2021 at 1:11 PM Christophe Leroy wrote: > Le 24/08/2021 à 16:47, Paul Moore a écrit : > > On Tue, Aug 24, 2021 at 9:36 AM Christophe Leroy > > wrote: > >> > >> Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal > >> targets") added generic support for AUDIT but that

Re: [ghak-trim PATCH v1] audit: move put_tree() to avoid trim_trees refcount underflow and UAF

2021-08-24 Thread Paul Moore
On Mon, Aug 23, 2021 at 10:05 PM Richard Guy Briggs wrote: > > AUDIT_TRIM is expected to be idempotent, but multiple executions resulted in a > refcount underflow and use-after-free. > > git bisect fingered commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca (2019-11) > ("locking/refcount: Con

Re: [RFC PATCH v2 0/9] Add LSM access controls and auditing to io_uring

2021-08-24 Thread Paul Moore
On Tue, Aug 24, 2021 at 4:57 PM Richard Guy Briggs wrote: > Thanks for the tests. I have a bunch of userspace patches to add to the > last set I posted and these tests will help exercise them. I also have > one more kernel patch to post... I'll dive back into that now. I had > wanted to post t

Re: [RFC PATCH v2 0/9] Add LSM access controls and auditing to io_uring

2021-08-24 Thread Richard Guy Briggs
On 2021-08-11 16:48, Paul Moore wrote: > Draft #2 of the patchset which brings auditing and proper LSM access > controls to the io_uring subsystem. The original patchset was posted > in late May and can be found via lore using the link below: > > https://lore.kernel.org/linux-security-module/1621

Re: [PATCH v2 RESEND] powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC

2021-08-24 Thread Christophe Leroy
Le 24/08/2021 à 16:47, Paul Moore a écrit : On Tue, Aug 24, 2021 at 9:36 AM Christophe Leroy wrote: Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal targets") added generic support for AUDIT but that didn't include support for bi-arch like powerpc. Commit 4b58841149dc ("aud

Re: [PATCH v28 22/25] Audit: Add record for multiple process LSM attributes

2021-08-24 Thread Paul Moore
On Tue, Aug 24, 2021 at 11:20 AM Casey Schaufler wrote: > On 8/24/2021 7:45 AM, Paul Moore wrote: > > On Fri, Aug 20, 2021 at 7:48 PM Casey Schaufler > > wrote: > >>> On 8/20/2021 12:06 PM, Paul Moore wrote: > Unless you explicitly enable audit on the kernel cmdline, e.g. > "audit=1",

Re: [PATCH v28 22/25] Audit: Add record for multiple process LSM attributes

2021-08-24 Thread Casey Schaufler
On 8/24/2021 7:45 AM, Paul Moore wrote: > On Fri, Aug 20, 2021 at 7:48 PM Casey Schaufler > wrote: >>> On 8/20/2021 12:06 PM, Paul Moore wrote: Unless you explicitly enable audit on the kernel cmdline, e.g. "audit=1", processes started before userspace enables audit will not have a

Re: [PATCH v2 RESEND] powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC

2021-08-24 Thread Paul Moore
On Tue, Aug 24, 2021 at 9:36 AM Christophe Leroy wrote: > > Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal > targets") added generic support for AUDIT but that didn't include > support for bi-arch like powerpc. > > Commit 4b58841149dc ("audit: Add generic compat syscall support"

Re: [PATCH v28 22/25] Audit: Add record for multiple process LSM attributes

2021-08-24 Thread Paul Moore
On Fri, Aug 20, 2021 at 7:48 PM Casey Schaufler wrote: > > On 8/20/2021 12:06 PM, Paul Moore wrote: > >> Unless you explicitly enable audit on the kernel cmdline, e.g. > >> "audit=1", processes started before userspace enables audit will not > >> have a properly allocated audit_context; see the "i

[PATCH v2 RESEND] powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC

2021-08-24 Thread Christophe Leroy
Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal targets") added generic support for AUDIT but that didn't include support for bi-arch like powerpc. Commit 4b58841149dc ("audit: Add generic compat syscall support") added generic support for bi-arch. Convert powerpc to that bi-arc

Re: [ghak-trim PATCH v1] audit: move put_tree() to avoid trim_trees refcount underflow and UAF

2021-08-24 Thread Jan Kara
On Mon 23-08-21 22:04:09, Richard Guy Briggs wrote: > AUDIT_TRIM is expected to be idempotent, but multiple executions resulted in a > refcount underflow and use-after-free. > > git bisect fingered commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca (2019-11) > ("locking/refcount: Consolidate im