Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Casey Schaufler
On 7/13/2020 6:19 PM, Paul Moore wrote: > On Mon, Jul 13, 2020 at 9:08 PM Richard Guy Briggs wrote: >> On 2020-07-13 20:11, Paul Moore wrote: >>> On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler >>> wrote: ... but it does appear that I could switch to using your audit_alloc_local().

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Paul Moore
On Mon, Jul 13, 2020 at 9:08 PM Richard Guy Briggs wrote: > On 2020-07-13 20:11, Paul Moore wrote: > > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler > > wrote: > > > ... but it does appear that I could switch to using your > > > audit_alloc_local(). > > > > In my opinion, linking the audit

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Richard Guy Briggs
On 2020-07-13 20:11, Paul Moore wrote: > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler > wrote: > > ... but it does appear that I could switch to using your > > audit_alloc_local(). > > In my opinion, linking the audit container ID and LSM stacking > patchsets would seem like a very big

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Paul Moore
On Mon, Jul 13, 2020 at 8:28 PM Casey Schaufler wrote: > On 7/13/2020 5:11 PM, Paul Moore wrote: > > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler > > wrote: > >> ... but it does appear that I could switch to using your > >> audit_alloc_local(). > > In my opinion, linking the audit container

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Casey Schaufler
On 7/13/2020 5:11 PM, Paul Moore wrote: > On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler > wrote: >> ... but it does appear that I could switch to using your audit_alloc_local(). > In my opinion, linking the audit container ID and LSM stacking > patchsets would seem like a very big mistake,

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Paul Moore
On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler wrote: > ... but it does appear that I could switch to using your audit_alloc_local(). In my opinion, linking the audit container ID and LSM stacking patchsets would seem like a very big mistake, especially since the consolidation you are

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Casey Schaufler
On 7/13/2020 1:02 PM, Richard Guy Briggs wrote: > On 2020-07-13 10:55, Casey Schaufler wrote: >> On 7/13/2020 10:40 AM, Richard Guy Briggs wrote: >>> On 2020-07-08 18:49, Paul Moore wrote: On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > When there are no rules present, the

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Steve Grubb
On Monday, July 13, 2020 6:30:51 PM EDT Paul Moore wrote: > On Mon, Jul 13, 2020 at 1:40 PM Richard Guy Briggs wrote: > > On 2020-07-08 18:49, Paul Moore wrote: > > > On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > > > > When there are no rules present, the event SOCKADDR record is

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Paul Moore
On Mon, Jul 13, 2020 at 1:40 PM Richard Guy Briggs wrote: > On 2020-07-08 18:49, Paul Moore wrote: > > On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > > > When there are no rules present, the event SOCKADDR record is not > > > generated due to audit_dummy_context() generated at

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Richard Guy Briggs
On 2020-07-13 10:55, Casey Schaufler wrote: > On 7/13/2020 10:40 AM, Richard Guy Briggs wrote: > > On 2020-07-08 18:49, Paul Moore wrote: > >> On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > >>> When there are no rules present, the event SOCKADDR record is not > >>> generated due to

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Casey Schaufler
On 7/13/2020 10:40 AM, Richard Guy Briggs wrote: > On 2020-07-08 18:49, Paul Moore wrote: >> On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: >>> When there are no rules present, the event SOCKADDR record is not >>> generated due to audit_dummy_context() generated at syscall entry from

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-13 Thread Richard Guy Briggs
On 2020-07-08 18:49, Paul Moore wrote: > On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > > When there are no rules present, the event SOCKADDR record is not > > generated due to audit_dummy_context() generated at syscall entry from > > audit_n_rules. Store this information if there is

Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-08 Thread Paul Moore
On Fri, Jul 3, 2020 at 1:18 PM Richard Guy Briggs wrote: > > When there are no rules present, the event SOCKADDR record is not > generated due to audit_dummy_context() generated at syscall entry from > audit_n_rules. Store this information if there is a context present to > store it so that

[PATCH ghak122 v1] audit: store event sockaddr in case of no rules

2020-07-03 Thread Richard Guy Briggs
When there are no rules present, the event SOCKADDR record is not generated due to audit_dummy_context() generated at syscall entry from audit_n_rules. Store this information if there is a context present to store it so that mandatory events are more complete (startup, LSMs...). Please see the