Re: [RFC PATCH 4/9] audit: add filtering for io_uring records

2021-06-02 Thread Paul Moore
On Wed, Jun 2, 2021 at 11:38 AM Richard Guy Briggs wrote: > On 2021-06-01 21:40, Paul Moore wrote: > > On Mon, May 31, 2021 at 9:44 AM Richard Guy Briggs wrote: > > > On 2021-05-30 11:26, Paul Moore wrote: > > > > On Fri, May 28, 2021 at 6:36 PM Richard Guy Briggs > > > > wrote: > > > > > On

Re: [RFC PATCH 4/9] audit: add filtering for io_uring records

2021-06-02 Thread Richard Guy Briggs
On 2021-06-01 21:40, Paul Moore wrote: > On Mon, May 31, 2021 at 9:44 AM Richard Guy Briggs wrote: > > On 2021-05-30 11:26, Paul Moore wrote: > > > On Fri, May 28, 2021 at 6:36 PM Richard Guy Briggs > > > wrote: > > > > On 2021-05-21 17:50, Paul Moore wrote: > > > > If we abuse the syscall

Re: [RFC PATCH 4/9] audit: add filtering for io_uring records

2021-06-01 Thread Paul Moore
On Mon, May 31, 2021 at 9:44 AM Richard Guy Briggs wrote: > On 2021-05-30 11:26, Paul Moore wrote: > > On Fri, May 28, 2021 at 6:36 PM Richard Guy Briggs wrote: > > > On 2021-05-21 17:50, Paul Moore wrote: ... > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > > index

Re: [RFC PATCH 4/9] audit: add filtering for io_uring records

2021-05-31 Thread Richard Guy Briggs
On 2021-05-30 11:26, Paul Moore wrote: > On Fri, May 28, 2021 at 6:36 PM Richard Guy Briggs wrote: > > On 2021-05-21 17:50, Paul Moore wrote: > > > WARNING - This is a work in progress and should not be merged > > > anywhere important. It is almost surely not complete, and while it > > >

Re: [RFC PATCH 4/9] audit: add filtering for io_uring records

2021-05-30 Thread Paul Moore
On Fri, May 28, 2021 at 6:36 PM Richard Guy Briggs wrote: > On 2021-05-21 17:50, Paul Moore wrote: > > WARNING - This is a work in progress and should not be merged > > anywhere important. It is almost surely not complete, and while it > > probably compiles it likely hasn't been booted and will

[RFC PATCH 4/9] audit: add filtering for io_uring records

2021-05-21 Thread Paul Moore
WARNING - This is a work in progress and should not be merged anywhere important. It is almost surely not complete, and while it probably compiles it likely hasn't been booted and will do terrible things. You have been warned. This patch adds basic audit io_uring filtering, using as much of the