From: Tony Jones <tonyj@suse.de>
To: Steve Grubb <sgrubb@redhat.com>, Tyler Hicks <tyhicks@canonical.com>
Cc: wpreston@suse.com, linux-audit@redhat.com, seth.arnold@canonical.com
Subject: Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
Date: Fri, 30 May 2014 17:01:39 -0700 [thread overview]
Message-ID: <53891BE3.3060409@suse.de> (raw)
In-Reply-To: <9810096.ghxOlbMYMG@x2>
On 05/30/2014 02:00 PM, Steve Grubb wrote:
> This is a big mistake, IMHO. In theory, this is what should have happened:
> An access decisionl event should have been named in the 1500 block. It would
> then be free to include the field it needs in the order it needs. The ausearch
> would get a function parse_aa_decision. That function would stuff a struct
> specially tuned for AA usage. Aureport would gain a new report.
The very original AA submission logged everything from the kernel using AUDIT_AA which was defined in the submission as:
+#define AUDIT_AA 1500 /* AppArmor audit */
I'm not sure when the change was made to call common_lsm_audit() which logs as AUDIT_AVC. I agree with Steve, doesn't seem a good idea.
tony
next prev parent reply other threads:[~2014-05-31 0:01 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-28 22:33 [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log Tony Jones
2014-05-29 8:31 ` Tyler Hicks
2014-05-29 15:01 ` Steve Grubb
2014-05-29 15:15 ` Tyler Hicks
2014-06-03 1:00 ` Tony Jones
2014-06-03 14:47 ` Steve Grubb
2014-06-03 16:34 ` Tony Jones
2014-05-29 15:21 ` Tyler Hicks
2014-05-30 19:53 ` Steve Grubb
2014-05-30 20:16 ` Tyler Hicks
2014-05-30 21:00 ` Steve Grubb
2014-05-31 0:01 ` Tony Jones [this message]
2014-06-06 18:46 ` Tyler Hicks
2014-06-06 21:10 ` Tyler Hicks
2014-06-24 0:06 ` Tony Jones
2014-06-24 15:34 ` Eric Paris
-- strict thread matches above, loose matches on Subject: below --
2016-04-29 7:03 Vincas Dargis
2016-04-29 13:39 ` Steve Grubb
2016-04-29 16:07 ` Vincas Dargis
2016-04-29 16:30 ` Steve Grubb
2016-05-02 21:18 ` Paul Moore
2016-04-29 15:41 ` Richard Guy Briggs
2016-04-29 16:58 ` Vincas Dargis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53891BE3.3060409@suse.de \
--to=tonyj@suse.de \
--cc=linux-audit@redhat.com \
--cc=seth.arnold@canonical.com \
--cc=sgrubb@redhat.com \
--cc=tyhicks@canonical.com \
--cc=wpreston@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.