From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH 0/5] Add support for sessionid user filters, sessionid_set and loginuid_set Date: Tue, 02 Aug 2016 09:25:44 -0400 Message-ID: <1631071.bJV1sPFgiU@x2> References: <1470130741-31650-1-git-send-email-rgb@redhat.com> <2972985.6eL3t5tKut@x2> <20160802125635.GX10734@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20160802125635.GX10734@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, August 2, 2016 8:56:35 AM EDT Richard Guy Briggs wrote: > On 2016-08-02 08:16, Steve Grubb wrote: > > On Tuesday, August 2, 2016 5:38:56 AM EDT Richard Guy Briggs wrote: > > > Add support for sessionid, sessionid_set (first two patches) and > > > loginuid_set (and auid_set) (third patch) in user filters. The first > > > > > > two are directly related to issue "ghak4": > > > https://github.com/linux-audit/audit-kernel/issues/4 > > > https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-> > > User-Filter > > > > > > The third is to support a kernel change from 3.10 and 3.19 to avoid > > > using in-band values to indicate the loginuid is unset. > > > > Have the above three patches been tested on old kernels? > > Not yet. How do you usually add new features to userspace to guard > against missing features from old kernels? Time to add a bit to the > kenrel audit status feature field? Yes. Otherwise you get EINVAL which doesn't let you explain what exactly is wrong with the rule. Thanks, -Steve > > > The last two patches are to add unset flags to sessionid and loginuid > > > for ausearch and aureport. These two patches are extras and not > > > required for basic support. > > > > I don't understand what the point of these last two items are. If the > > session is not set, we have ses=4294967295 in the audit trail. That can > > already be specified in ausearch as --session -1. I also am not sure that > > session information makes any sense for aureport because we have aulast > > which reports on session activity for users. > > I was starting to doubt the utility of these last two patches which is > why I tagged them optional. Please use any bits or ideas that might be > useful, otherwise drop them. > > > -Steve > > - RGB > > -- > Richard Guy Briggs > Kernel Security Engineering, Base Operating Systems, Red Hat > Remote, Ottawa, Canada > Voice: +1.647.777.2635, Internal: (81) 32635