Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-31 Thread Richard Guy Briggs
On 2018-07-25 20:51, Richard Guy Briggs wrote: > On 2018-07-23 14:31, Paul Moore wrote: > > On Mon, Jul 23, 2018 at 12:48 PM Steve Grubb wrote: > > > On Monday, July 23, 2018 11:11:48 AM EDT Richard Guy Briggs wrote: > > > > On 2018-07-23 09:19, Steve Grubb wrote: > > > > > On Sunday, July 22,

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-25 Thread Richard Guy Briggs
On 2018-07-23 14:31, Paul Moore wrote: > On Mon, Jul 23, 2018 at 12:48 PM Steve Grubb wrote: > > On Monday, July 23, 2018 11:11:48 AM EDT Richard Guy Briggs wrote: > > > On 2018-07-23 09:19, Steve Grubb wrote: > > > > On Sunday, July 22, 2018 4:55:10 PM EDT Richard Guy Briggs wrote: > > > > > On

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-23 Thread Paul Moore
On Mon, Jul 23, 2018 at 12:48 PM Steve Grubb wrote: > On Monday, July 23, 2018 11:11:48 AM EDT Richard Guy Briggs wrote: > > On 2018-07-23 09:19, Steve Grubb wrote: > > > On Sunday, July 22, 2018 4:55:10 PM EDT Richard Guy Briggs wrote: > > > > On 2018-07-22 09:32, Steve Grubb wrote: > > > > > On

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-23 Thread Steve Grubb
On Monday, July 23, 2018 11:11:48 AM EDT Richard Guy Briggs wrote: > On 2018-07-23 09:19, Steve Grubb wrote: > > On Sunday, July 22, 2018 4:55:10 PM EDT Richard Guy Briggs wrote: > > > On 2018-07-22 09:32, Steve Grubb wrote: > > > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-23 Thread Richard Guy Briggs
On 2018-07-23 09:19, Steve Grubb wrote: > On Sunday, July 22, 2018 4:55:10 PM EDT Richard Guy Briggs wrote: > > On 2018-07-22 09:32, Steve Grubb wrote: > > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > > > + * audit_log_contid - report container info > > > > > > + *

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-23 Thread Steve Grubb
On Sunday, July 22, 2018 4:55:10 PM EDT Richard Guy Briggs wrote: > On 2018-07-22 09:32, Steve Grubb wrote: > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > > + * audit_log_contid - report container info > > > > > + * @tsk: task to be recorded > > > > > + * @context:

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-23 Thread Paul Moore
On Sat, Jul 21, 2018 at 4:32 PM Richard Guy Briggs wrote: > On 2018-07-20 18:13, Paul Moore wrote: > > On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs wrote: > > > Create a new audit record AUDIT_CONTAINER to document the audit > > > container identifier of a process if it is present. > > > >

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-22 Thread Richard Guy Briggs
On 2018-07-22 16:55, Richard Guy Briggs wrote: > On 2018-07-22 09:32, Steve Grubb wrote: > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > > + * audit_log_contid - report container info > > > > > + * @tsk: task to be recorded > > > > > + * @context: task or local

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-22 Thread Richard Guy Briggs
On 2018-07-22 09:32, Steve Grubb wrote: > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > + * audit_log_contid - report container info > > > > + * @tsk: task to be recorded > > > > + * @context: task or local context for record > > > > + * @op: contid string description

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-22 Thread Steve Grubb
On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > + * audit_log_contid - report container info > > > + * @tsk: task to be recorded > > > + * @context: task or local context for record > > > + * @op: contid string description > > > + */ > > > +int audit_log_contid(struct

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-21 Thread Richard Guy Briggs
On 2018-07-20 18:13, Paul Moore wrote: > On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs wrote: > > Create a new audit record AUDIT_CONTAINER to document the audit > > container identifier of a process if it is present. > > > > Called from audit_log_exit(), syscalls are covered. > > > > A

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-07-20 Thread Paul Moore
On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs wrote: > Create a new audit record AUDIT_CONTAINER to document the audit > container identifier of a process if it is present. > > Called from audit_log_exit(), syscalls are covered. > > A sample raw event: > type=SYSCALL

Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-06-06 Thread Steve Grubb
On Wednesday, June 6, 2018 12:58:29 PM EDT Richard Guy Briggs wrote: > Create a new audit record AUDIT_CONTAINER to document the audit > container identifier of a process if it is present. > > Called from audit_log_exit(), syscalls are covered. > > A sample raw event: > type=SYSCALL

[RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls

2018-06-06 Thread Richard Guy Briggs
Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present. Called from audit_log_exit(), syscalls are covered. A sample raw event: type=SYSCALL msg=audit(1519924845.499:257): arch=c03e syscall=257 success=yes exit=3 a0=ff9c