Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-04-01 Thread Phil Sutter
On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > Reduce logging of nftables events to a level similar to iptables. > Restore the table field to list the table, adding the generation. > > Indicate the op as the most significant operation in the event. > > A couple of sample

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-04-01 Thread Richard Guy Briggs
On 2021-04-01 15:24, Phil Sutter wrote: > On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > > Reduce logging of nftables events to a level similar to iptables. > > Restore the table field to list the table, adding the generation. > > > > Indicate the op as the most significant

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-31 Thread Pablo Neira Ayuso
On Wed, Mar 31, 2021 at 04:53:10PM -0400, Richard Guy Briggs wrote: > On 2021-03-31 22:22, Pablo Neira Ayuso wrote: > > On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > > > Reduce logging of nftables events to a level similar to iptables. > > > Restore the table field to list

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-31 Thread Richard Guy Briggs
On 2021-03-31 22:46, Pablo Neira Ayuso wrote: > On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > > @@ -8006,12 +7966,65 @@ static void nft_commit_notify(struct net *net, u32 > > portid) > > WARN_ON_ONCE(!list_empty(>nft.notify_list)); > > } > > > > +static int

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-31 Thread Richard Guy Briggs
On 2021-03-31 22:22, Pablo Neira Ayuso wrote: > On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > > Reduce logging of nftables events to a level similar to iptables. > > Restore the table field to list the table, adding the generation. > > > > Indicate the op as the most

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-31 Thread Pablo Neira Ayuso
On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > @@ -8006,12 +7966,65 @@ static void nft_commit_notify(struct net *net, u32 > portid) > WARN_ON_ONCE(!list_empty(>nft.notify_list)); > } > > +static int nf_tables_commit_audit_alloc(struct list_head *adl, > +

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-31 Thread Pablo Neira Ayuso
On Fri, Mar 26, 2021 at 01:38:59PM -0400, Richard Guy Briggs wrote: > Reduce logging of nftables events to a level similar to iptables. > Restore the table field to list the table, adding the generation. > > Indicate the op as the most significant operation in the event. There's a UAF, Florian

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-30 Thread Paul Moore
On Tue, Mar 30, 2021 at 6:53 PM Pablo Neira Ayuso wrote: > On Sun, Mar 28, 2021 at 08:50:45PM -0400, Paul Moore wrote: > [...] > > Netfilter folks, were you planning to pull this via your tree/netdev > > or would you like me to merge this via the audit tree? If the latter, > > I would appreciate

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-30 Thread Pablo Neira Ayuso
On Sun, Mar 28, 2021 at 08:50:45PM -0400, Paul Moore wrote: [...] > Netfilter folks, were you planning to pull this via your tree/netdev > or would you like me to merge this via the audit tree? If the latter, > I would appreciate it if I could get an ACK from one of you; if the > former, my ACK

Re: [PATCH v5] audit: log nftables configuration change events once per table

2021-03-28 Thread Paul Moore
On Fri, Mar 26, 2021 at 1:39 PM Richard Guy Briggs wrote: > > Reduce logging of nftables events to a level similar to iptables. > Restore the table field to list the table, adding the generation. > > Indicate the op as the most significant operation in the event. > > A couple of sample events: >

[PATCH v5] audit: log nftables configuration change events once per table

2021-03-26 Thread Richard Guy Briggs
Reduce logging of nftables events to a level similar to iptables. Restore the table field to list the table, adding the generation. Indicate the op as the most significant operation in the event. A couple of sample events: type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) :