Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-11 Thread Daniel Borkmann
On Wed, Dec 11, 2019 at 11:21:33AM -0500, Paul Moore wrote: > On Wed, Dec 11, 2019 at 8:20 AM Daniel Borkmann wrote: > > On Tue, Dec 10, 2019 at 05:45:59PM -0500, Paul Moore wrote: > > > On Tue, Dec 10, 2019 at 10:37 AM Jiri Olsa wrote: > > > > On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-11 Thread Jiri Olsa
On Wed, Dec 11, 2019 at 11:21:33AM -0500, Paul Moore wrote: > On Wed, Dec 11, 2019 at 8:20 AM Daniel Borkmann wrote: > > On Tue, Dec 10, 2019 at 05:45:59PM -0500, Paul Moore wrote: > > > On Tue, Dec 10, 2019 at 10:37 AM Jiri Olsa wrote: > > > > On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-11 Thread Paul Moore
On Wed, Dec 11, 2019 at 8:20 AM Daniel Borkmann wrote: > On Tue, Dec 10, 2019 at 05:45:59PM -0500, Paul Moore wrote: > > On Tue, Dec 10, 2019 at 10:37 AM Jiri Olsa wrote: > > > On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore wrote: > > > > On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann > >

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-11 Thread Daniel Borkmann
On Tue, Dec 10, 2019 at 05:45:59PM -0500, Paul Moore wrote: > On Tue, Dec 10, 2019 at 10:37 AM Jiri Olsa wrote: > > On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore wrote: > > > On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann > > > wrote: > > > > On 12/9/19 3:56 PM, Paul Moore wrote: > > > >

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-10 Thread Paul Moore
On Tue, Dec 10, 2019 at 10:37 AM Jiri Olsa wrote: > On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore wrote: > > On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann wrote: > > > On 12/9/19 3:56 PM, Paul Moore wrote: > > > > On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann > > > > wrote: > > > >> On

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-10 Thread Jiri Olsa
On Mon, Dec 09, 2019 at 06:53:23PM -0500, Paul Moore wrote: > On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann wrote: > > On 12/9/19 3:56 PM, Paul Moore wrote: > > > On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann > > > wrote: > > >> On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > > >>

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Paul Moore
On Mon, Dec 9, 2019 at 6:19 PM Daniel Borkmann wrote: > On 12/9/19 3:56 PM, Paul Moore wrote: > > On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: > >> On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > >>> From: Daniel Borkmann > >>> > >>> Allow for audit messages to be emitted u

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Daniel Borkmann
On 12/9/19 3:56 PM, Paul Moore wrote: On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: From: Daniel Borkmann Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itsel

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Daniel Borkmann
On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > From: Daniel Borkmann > > Allow for audit messages to be emitted upon BPF program load and > unload for having a timeline of events. The load itself is in > syscall context, so additional info about the process initiating > the BPF prog

Re: [PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-09 Thread Paul Moore
On Mon, Dec 9, 2019 at 7:15 AM Daniel Borkmann wrote: > On Fri, Dec 06, 2019 at 10:49:34PM +0100, Jiri Olsa wrote: > > From: Daniel Borkmann > > > > Allow for audit messages to be emitted upon BPF program load and > > unload for having a timeline of events. The load itself is in > > syscall conte

[PATCHv3] bpf: Emit audit messages upon successful prog load and unload

2019-12-06 Thread Jiri Olsa
From: Daniel Borkmann Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload eve