Re: What does "---" in audit.log timestamp / event-id field mean?

2022-05-17 Thread Steve Grubb
Hello, On Thursday, May 12, 2022 4:01:34 AM EDT Sam Pinkus wrote: > I'm using auditd=1:2.8.4-3 on Debian. I got this event in my audit.log: > > > ... > type=SYSCALL msg=audit(16523210---): arch=c03e syscall=87 success=yes > exit=0 a0=7f867d66a3ed a1=7f867d66a3ed a2=0 a3=792f18 items=2 ppid=2

Re: [PATCH 1/1] audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts

2022-05-17 Thread Paul Moore
On Tue, May 17, 2022 at 9:12 AM Paul Moore wrote: > On Tue, May 17, 2022 at 6:33 AM Julian Orth wrote: > > > > Not calling the function for dummy contexts will cause the context to > > not be reset. During the next syscall, this will cause an error in > > __audit_syscall_entry: > > > > WA

Re: [PATCH 1/1] audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts

2022-05-17 Thread Paul Moore
On Tue, May 17, 2022 at 6:33 AM Julian Orth wrote: > > Not calling the function for dummy contexts will cause the context to > not be reset. During the next syscall, this will cause an error in > __audit_syscall_entry: > > WARN_ON(context->context != AUDIT_CTX_UNUSED); > WARN_ON(co

[PATCH 1/1] audit, io_uring, io-wq: call __audit_uring_exit for dummy contexts

2022-05-17 Thread Julian Orth
Not calling the function for dummy contexts will cause the context to not be reset. During the next syscall, this will cause an error in __audit_syscall_entry: WARN_ON(context->context != AUDIT_CTX_UNUSED); WARN_ON(context->name_count); if (context->context != AUDIT_CTX_UNU

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread kernel test robot
suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/intel-lab-lkp/linux/commits/Richard-Guy-Briggs/fanotify-Allow-user-space-to-pass-back-additional-audit-info/20220517-044904 base: https://git.kernel.org/pub/scm/linux/kerne

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread Amir Goldstein
On Tue, May 17, 2022 at 2:31 PM Amir Goldstein wrote: > > On Tue, May 17, 2022 at 1:32 PM Jan Kara wrote: > > > > On Tue 17-05-22 08:37:28, Amir Goldstein wrote: > > > On Mon, May 16, 2022 at 11:22 PM Richard Guy Briggs > > > wrote: > > > > > > > > This patch adds 2 structure members to the res

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread Amir Goldstein
On Mon, May 16, 2022 at 11:22 PM Richard Guy Briggs wrote: > > This patch adds 2 structure members to the response returned from user > space on a permission event. The first field is 32 bits for the context > type. The context type will describe what the meaning is of the second > field. The def

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread kernel test robot
submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/intel-lab-lkp/linux/commits/Richard-Guy-Briggs/fanotify-Allow-user-space-to-pass-back-additional-audit-info/20220517-044904 base: https://git.kernel.org/pub

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread Amir Goldstein
On Tue, May 17, 2022 at 1:32 PM Jan Kara wrote: > > On Tue 17-05-22 08:37:28, Amir Goldstein wrote: > > On Mon, May 16, 2022 at 11:22 PM Richard Guy Briggs wrote: > > > > > > This patch adds 2 structure members to the response returned from user > > > space on a permission event. The first field

Re: [PATCH v3 2/3] fanotify: define struct members to hold response decision context

2022-05-17 Thread Jan Kara
On Tue 17-05-22 08:37:28, Amir Goldstein wrote: > On Mon, May 16, 2022 at 11:22 PM Richard Guy Briggs wrote: > > > > This patch adds 2 structure members to the response returned from user > > space on a permission event. The first field is 32 bits for the context > > type. The context type will d

[PATCH 0/1] audit, io_uring, io-wq: call __audit_uring_exit for dummy contexts

2022-05-17 Thread Julian Orth
After porting my wayland compositor to io_uring, I noticed that my logs were getting spammed with the following messages (tested with 5.17.7 and 5.18.0-rc7): WARNING: CPU: 10 PID: 983 at kernel/auditsc.c:2041 __audit_syscall_entry+0x1> Modules linked in: vrf wireguard curve25519_x86_64 li