Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

2017-10-19 Thread James Morris
On Thu, 19 Oct 2017, Richard Guy Briggs wrote: > On 2017-10-11 20:57, Richard Guy Briggs wrote: > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > application execution (SYSCALL execve). This is not expected as it was > > supposed to be limited to when the file system a

Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

2017-10-19 Thread Richard Guy Briggs
On 2017-10-20 01:29, James Morris wrote: > On Thu, 19 Oct 2017, Richard Guy Briggs wrote: > > > On 2017-10-11 20:57, Richard Guy Briggs wrote: > > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > > application execution (SYSCALL execve). This is not expected as it was >

Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

2017-10-19 Thread James Morris
On Thu, 19 Oct 2017, Richard Guy Briggs wrote: > On 2017-10-11 20:57, Richard Guy Briggs wrote: > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > application execution (SYSCALL execve). This is not expected as it was > > supposed to be limited to when the file system a

Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

2017-10-19 Thread Richard Guy Briggs
On 2017-10-11 20:57, Richard Guy Briggs wrote: > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > application execution (SYSCALL execve). This is not expected as it was > supposed to be limited to when the file system actually had capabilities > in an extended attribute. It

[PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id

2017-10-11 Thread Richard Guy Briggs
The audit subsystem is adding a BPRM_FCAPS record when auditing setuid application execution (SYSCALL execve). This is not expected as it was supposed to be limited to when the file system actually had capabilities in an extended attribute. It lists all capabilities making the event really ugly to