From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH 0/5] Add support for sessionid user filters, sessionid_set and loginuid_set Date: Tue, 02 Aug 2016 08:16:45 -0400 Message-ID: <2972985.6eL3t5tKut@x2> References: <1470130741-31650-1-git-send-email-rgb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1470130741-31650-1-git-send-email-rgb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, August 2, 2016 5:38:56 AM EDT Richard Guy Briggs wrote: > Add support for sessionid, sessionid_set (first two patches) and > loginuid_set (and auid_set) (third patch) in user filters. The first > two are directly related to issue "ghak4": > https://github.com/linux-audit/audit-kernel/issues/4 > https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User > -Filter > > The third is to support a kernel change from 3.10 and 3.19 to avoid > using in-band values to indicate the loginuid is unset. Have the above three patches been tested on old kernels? > The last two patches are to add unset flags to sessionid and loginuid > for ausearch and aureport. These two patches are extras and not > required for basic support. I don't understand what the point of these last two items are. If the session is not set, we have ses=4294967295 in the audit trail. That can already be specified in ausearch as --session -1. I also am not sure that session information makes any sense for aureport because we have aulast which reports on session activity for users. -Steve