Re: [PATCH v3] audit: log nftables configuration change events once per table

2021-03-24 Thread Richard Guy Briggs
On 2021-03-24 12:32, Paul Moore wrote: > On Tue, Mar 23, 2021 at 4:05 PM Richard Guy Briggs wrote: > > > > Reduce logging of nftables events to a level similar to iptables. > > Restore the table field to list the table, adding the generation. > > > > Indicate the op as the most significant

Re: [PATCH v3] audit: log nftables configuration change events once per table

2021-03-24 Thread Paul Moore
On Tue, Mar 23, 2021 at 4:05 PM Richard Guy Briggs wrote: > > Reduce logging of nftables events to a level similar to iptables. > Restore the table field to list the table, adding the generation. > > Indicate the op as the most significant operation in the event. > > A couple of sample events: >

Re: [PATCH v3] audit: log nftables configuration change events once per table

2021-03-23 Thread Florian Westphal
Richard Guy Briggs wrote: > nft_commit_notify(net, NETLINK_CB(skb).portid); > nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); > nf_tables_commit_release(net); > > + nf_tables_commit_audit_log(, net->nft.base_seq); This meeds to be before nf_tables_commit_release() call,

[PATCH v3] audit: log nftables configuration change events once per table

2021-03-23 Thread Richard Guy Briggs
Reduce logging of nftables events to a level similar to iptables. Restore the table field to list the table, adding the generation. Indicate the op as the most significant operation in the event. A couple of sample events: type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) :