Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-03-12 Thread Paul Moore
On Mon, Mar 12, 2018 at 3:59 AM, Richard Guy Briggs wrote: > On 2018-03-08 19:50, Paul Moore wrote: ... >> (Point #2 is why I didn't merge patch 3/4, just include it in this >> revised patch) > > On reviewing this, I'm not totally convinced the parent record is > necessary to

Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-03-12 Thread Richard Guy Briggs
On 2018-03-08 19:50, Paul Moore wrote: > On Wed, Feb 14, 2018 at 11:18 AM, Richard Guy Briggs wrote: > > Audit link denied events for symlinks were missing the parent PATH > > record. Add it. Since the full pathname may not be available, > > reconstruct it from the path in the

Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-03-08 Thread Paul Moore
On Wed, Feb 14, 2018 at 11:18 AM, Richard Guy Briggs wrote: > Audit link denied events for symlinks were missing the parent PATH > record. Add it. Since the full pathname may not be available, > reconstruct it from the path in the nameidata supplied. > > See:

Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-02-16 Thread Paul Moore
On Thu, Feb 15, 2018 at 9:59 PM, Richard Guy Briggs wrote: > On 2018-02-15 18:34, Paul Moore wrote: >> On Wed, Feb 14, 2018 at 11:18 AM, Richard Guy Briggs wrote: >> > Audit link denied events for symlinks were missing the parent PATH >> > record. Add it.

Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-02-15 Thread Richard Guy Briggs
On 2018-02-15 18:34, Paul Moore wrote: > On Wed, Feb 14, 2018 at 11:18 AM, Richard Guy Briggs wrote: > > Audit link denied events for symlinks were missing the parent PATH > > record. Add it. Since the full pathname may not be available, > > reconstruct it from the path in the

Re: [RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-02-15 Thread Paul Moore
On Wed, Feb 14, 2018 at 11:18 AM, Richard Guy Briggs wrote: > Audit link denied events for symlinks were missing the parent PATH > record. Add it. Since the full pathname may not be available, > reconstruct it from the path in the nameidata supplied. > > See:

[RFC PATCH ghak21 4/4] audit: add parent of refused symlink to audit_names

2018-02-14 Thread Richard Guy Briggs
Audit link denied events for symlinks were missing the parent PATH record. Add it. Since the full pathname may not be available, reconstruct it from the path in the nameidata supplied. See: https://github.com/linux-audit/audit-kernel/issues/21 Signed-off-by: Richard Guy Briggs