Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-09 Thread Richard Guy Briggs
On 2022-09-09 10:55, Steve Grubb wrote: > On Friday, September 9, 2022 10:38:46 AM EDT Richard Guy Briggs wrote: > > > Richard, add subj_trust and obj_trust. These can be 0|1|2 for no, yes, > > > unknown. > > > > type? bitfield? My gut would say that "0" should be "unset"/"unknown", > > but tha

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-09 Thread Steve Grubb
On Friday, September 9, 2022 10:38:46 AM EDT Richard Guy Briggs wrote: > > Richard, add subj_trust and obj_trust. These can be 0|1|2 for no, yes, > > unknown. > > type? bitfield? My gut would say that "0" should be "unset"/"unknown", > but that is counterintuitive to the values represented. > >

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-09 Thread Richard Guy Briggs
On 2022-09-09 10:22, Steve Grubb wrote: > On Friday, September 9, 2022 7:09:44 AM EDT Jan Kara wrote: > > Hello Steve! > > > > On Fri 09-09-22 00:03:53, Steve Grubb wrote: > > > On Thursday, September 8, 2022 10:41:44 PM EDT Richard Guy Briggs wrote: > > > > > I'm trying to abide by what was sugge

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-09 Thread Steve Grubb
On Friday, September 9, 2022 7:09:44 AM EDT Jan Kara wrote: > Hello Steve! > > On Fri 09-09-22 00:03:53, Steve Grubb wrote: > > On Thursday, September 8, 2022 10:41:44 PM EDT Richard Guy Briggs wrote: > > > > I'm trying to abide by what was suggested by the fs-devel folks. I > > > > can > > > > li

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-09 Thread Jan Kara
Hello Steve! On Fri 09-09-22 00:03:53, Steve Grubb wrote: > On Thursday, September 8, 2022 10:41:44 PM EDT Richard Guy Briggs wrote: > > > I'm trying to abide by what was suggested by the fs-devel folks. I can > > > live with it. But if you want to make something non-generic for all > > > users of

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-08 Thread Steve Grubb
On Thursday, September 8, 2022 10:41:44 PM EDT Richard Guy Briggs wrote: > > I'm trying to abide by what was suggested by the fs-devel folks. I can > > live with it. But if you want to make something non-generic for all > > users of fanotify, call the new field "trusted". This would decern when > >

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-08 Thread Paul Moore
On Thu, Sep 8, 2022 at 10:41 PM Richard Guy Briggs wrote: > On 2022-09-08 22:20, Steve Grubb wrote: > > On Thursday, September 8, 2022 5:22:15 PM EDT Paul Moore wrote: > > > On Thu, Sep 8, 2022 at 5:14 PM Steve Grubb wrote: > > > > On Wednesday, September 7, 2022 4:23:49 PM EDT Paul Moore wrote:

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-08 Thread Richard Guy Briggs
On 2022-09-08 22:20, Steve Grubb wrote: > On Thursday, September 8, 2022 5:22:15 PM EDT Paul Moore wrote: > > On Thu, Sep 8, 2022 at 5:14 PM Steve Grubb wrote: > > > On Wednesday, September 7, 2022 4:23:49 PM EDT Paul Moore wrote: > > > > On Wed, Sep 7, 2022 at 4:11 PM Steve Grubb wrote: > > > >

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-08 Thread Steve Grubb
On Thursday, September 8, 2022 5:22:15 PM EDT Paul Moore wrote: > On Thu, Sep 8, 2022 at 5:14 PM Steve Grubb wrote: > > On Wednesday, September 7, 2022 4:23:49 PM EDT Paul Moore wrote: > > > On Wed, Sep 7, 2022 at 4:11 PM Steve Grubb wrote: > > > > On Wednesday, September 7, 2022 2:43:54 PM EDT R

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-08 Thread Paul Moore
On Thu, Sep 8, 2022 at 5:14 PM Steve Grubb wrote: > On Wednesday, September 7, 2022 4:23:49 PM EDT Paul Moore wrote: > > On Wed, Sep 7, 2022 at 4:11 PM Steve Grubb wrote: > > > On Wednesday, September 7, 2022 2:43:54 PM EDT Richard Guy Briggs wrote: > > > > > > Ultimately I guess I'll leave it up

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-08 Thread Steve Grubb
On Wednesday, September 7, 2022 4:23:49 PM EDT Paul Moore wrote: > On Wed, Sep 7, 2022 at 4:11 PM Steve Grubb wrote: > > On Wednesday, September 7, 2022 2:43:54 PM EDT Richard Guy Briggs wrote: > > > > > Ultimately I guess I'll leave it upto audit subsystem what it wants > > > > > to > > > > > hav

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-07 Thread Paul Moore
On Wed, Sep 7, 2022 at 4:11 PM Steve Grubb wrote: > On Wednesday, September 7, 2022 2:43:54 PM EDT Richard Guy Briggs wrote: > > > > Ultimately I guess I'll leave it upto audit subsystem what it wants to > > > > have in its struct fanotify_response_info_audit_rule because for > > > > fanotify subs

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-09-07 Thread Steve Grubb
On Wednesday, September 7, 2022 2:43:54 PM EDT Richard Guy Briggs wrote: > > > Ultimately I guess I'll leave it upto audit subsystem what it wants to > > > have in its struct fanotify_response_info_audit_rule because for > > > fanotify subsystem, it is just an opaque blob it is passing. > > > > In

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-07 Thread Richard Guy Briggs
On 2022-09-01 14:31, Paul Moore wrote: > On Thu, Sep 1, 2022 at 3:52 AM Jan Kara wrote: > > On Wed 31-08-22 21:47:09, Paul Moore wrote: > > > On Wed, Aug 31, 2022 at 7:55 PM Steve Grubb wrote: > > > > On Wednesday, August 31, 2022 6:19:40 PM EDT Richard Guy Briggs wrote: > > > > > On 2022-08-31 1

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-01 Thread Paul Moore
On Thu, Sep 1, 2022 at 3:52 AM Jan Kara wrote: > On Wed 31-08-22 21:47:09, Paul Moore wrote: > > On Wed, Aug 31, 2022 at 7:55 PM Steve Grubb wrote: > > > On Wednesday, August 31, 2022 6:19:40 PM EDT Richard Guy Briggs wrote: > > > > On 2022-08-31 17:25, Steve Grubb wrote: > > > > > On Wednesday,

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-09-01 Thread Jan Kara
On Wed 31-08-22 21:47:09, Paul Moore wrote: > On Wed, Aug 31, 2022 at 7:55 PM Steve Grubb wrote: > > On Wednesday, August 31, 2022 6:19:40 PM EDT Richard Guy Briggs wrote: > > > On 2022-08-31 17:25, Steve Grubb wrote: > > > > On Wednesday, August 31, 2022 5:07:25 PM EDT Richard Guy Briggs wrote: >

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-08-31 Thread Paul Moore
On Wed, Aug 31, 2022 at 7:55 PM Steve Grubb wrote: > On Wednesday, August 31, 2022 6:19:40 PM EDT Richard Guy Briggs wrote: > > On 2022-08-31 17:25, Steve Grubb wrote: > > > On Wednesday, August 31, 2022 5:07:25 PM EDT Richard Guy Briggs wrote: > > > > > > diff --git a/kernel/auditsc.c b/kernel/au

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-08-31 Thread Steve Grubb
On Wednesday, August 31, 2022 6:19:40 PM EDT Richard Guy Briggs wrote: > On 2022-08-31 17:25, Steve Grubb wrote: > > On Wednesday, August 31, 2022 5:07:25 PM EDT Richard Guy Briggs wrote: > > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > > > index 433418d73584..f000fec52360 100644 >

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-08-31 Thread Richard Guy Briggs
On 2022-08-31 17:25, Steve Grubb wrote: > On Wednesday, August 31, 2022 5:07:25 PM EDT Richard Guy Briggs wrote: > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > > index 433418d73584..f000fec52360 100644 > > > > --- a/kernel/auditsc.c > > > > +++ b/kernel/auditsc.c > > > > @@ -64,6 +6

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-08-31 Thread Richard Guy Briggs
On 2022-08-15 20:22, Paul Moore wrote: > On Tue, Aug 9, 2022 at 1:23 PM Richard Guy Briggs wrote: > > > > This patch passes the full value so that the audit function can use all > > of it. The audit function was updated to log the additional information in > > the AUDIT_FANOTIFY record. The follow

Re: [PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-08-31 Thread Steve Grubb
On Wednesday, August 31, 2022 5:07:25 PM EDT Richard Guy Briggs wrote: > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > index 433418d73584..f000fec52360 100644 > > > --- a/kernel/auditsc.c > > > +++ b/kernel/auditsc.c > > > @@ -64,6 +64,7 @@ > > > #include > > > #include > > > #includ

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-08-15 Thread Paul Moore
On Tue, Aug 9, 2022 at 1:23 PM Richard Guy Briggs wrote: > > This patch passes the full value so that the audit function can use all > of it. The audit function was updated to log the additional information in > the AUDIT_FANOTIFY record. The following is an example of the new record > format: > >

Re: [PATCH v4 3/4] fanotify,audit: Allow audit to use the full permission event response

2022-08-10 Thread kernel test robot
Hi Richard, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on jack-fs/fsnotify] [also build test WARNING on pcmoore-audit/next linus/master v5.19 next-20220810] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we s

[PATCH v4 3/4] fanotify, audit: Allow audit to use the full permission event response

2022-08-09 Thread Richard Guy Briggs
This patch passes the full value so that the audit function can use all of it. The audit function was updated to log the additional information in the AUDIT_FANOTIFY record. The following is an example of the new record format: type=FANOTIFY msg=audit(1600385147.372:590): resp=2 fan_type=1 fan_inf