On 2021-10-21 15:00, Steve Grubb wrote:
> On Monday, October 4, 2021 2:27:18 PM EDT Richard Guy Briggs wrote:
> > > As a heads-up, I had to change the AUDIT_OPENAT2 value to 1337 as the
> > > 1336 value is already in use by AUDIT_URINGOP. It wasn't caught
> > > during my initial build test as the
On Monday, October 4, 2021 2:27:18 PM EDT Richard Guy Briggs wrote:
> > As a heads-up, I had to change the AUDIT_OPENAT2 value to 1337 as the
> > 1336 value is already in use by AUDIT_URINGOP. It wasn't caught
> > during my initial build test as the LSM/audit io_uring patches are in
> > selinux/ne
On 2021-10-04 12:08, Paul Moore wrote:
> On Wed, May 19, 2021 at 4:02 PM Richard Guy Briggs wrote:
> >
> > Since the openat2(2) syscall uses a struct open_how pointer to communicate
> > its parameters they are not usefully recorded by the audit SYSCALL record's
> > four existing arguments.
> >
> >
On Wed, May 19, 2021 at 4:02 PM Richard Guy Briggs wrote:
>
> Since the openat2(2) syscall uses a struct open_how pointer to communicate
> its parameters they are not usefully recorded by the audit SYSCALL record's
> four existing arguments.
>
> Add a new audit record type OPENAT2 that reports the
On 2021-05-24 19:08, Paul Moore wrote:
> On Thu, May 20, 2021 at 4:03 AM Christian Brauner
> wrote:
> > On Wed, May 19, 2021 at 04:00:22PM -0400, Richard Guy Briggs wrote:
> > > Since the openat2(2) syscall uses a struct open_how pointer to communicate
> > > its parameters they are not usefully re
On Thu, May 20, 2021 at 4:03 AM Christian Brauner
wrote:
> On Wed, May 19, 2021 at 04:00:22PM -0400, Richard Guy Briggs wrote:
> > Since the openat2(2) syscall uses a struct open_how pointer to communicate
> > its parameters they are not usefully recorded by the audit SYSCALL record's
> > four exi
On Wed, May 19, 2021 at 04:00:22PM -0400, Richard Guy Briggs wrote:
> Since the openat2(2) syscall uses a struct open_how pointer to communicate
> its parameters they are not usefully recorded by the audit SYSCALL record's
> four existing arguments.
>
> Add a new audit record type OPENAT2 that rep
Since the openat2(2) syscall uses a struct open_how pointer to communicate
its parameters they are not usefully recorded by the audit SYSCALL record's
four existing arguments.
Add a new audit record type OPENAT2 that reports the parameters in its
third argument, struct open_how with fields oflag,
