All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tony Jones <tonyj@suse.de>
To: Steve Grubb <sgrubb@redhat.com>
Cc: wpreston@suse.com, linux-audit@redhat.com, seth.arnold@canonical.com
Subject: Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
Date: Tue, 03 Jun 2014 09:34:25 -0700	[thread overview]
Message-ID: <538DF911.9010807@suse.de> (raw)
In-Reply-To: <1418765.RMuE53Kd9z@x2>

On 06/03/2014 07:47 AM, Steve Grubb wrote:
> Yep. So, the question is really how to fix this. Should we have a different 
> function that is swung in with #ifdef WITH_APPARMOR called parse_aa_avc? Then 
> it can be tuned exactly for AppArmor's needs? Later, the kernel event number 
> can be changed and the switch/case can pick that up. Also, are there other AA 
> events that are missing in action? The ausearch-test should tell you.

We'll take the patch (locally) for SLES.  Seems to me, since there really isn't any AppArmor awareness in audit at present that the AppArmor developers 
may as well fix the kernel event numbering first,  audit userspace after that .... anyhow, I see no point considering the previous patch for upstreaming.

Thanks

Tony

  reply	other threads:[~2014-06-03 16:34 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-05-28 22:33 [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log Tony Jones
2014-05-29  8:31 ` Tyler Hicks
2014-05-29 15:01   ` Steve Grubb
2014-05-29 15:15     ` Tyler Hicks
2014-06-03  1:00   ` Tony Jones
2014-06-03 14:47     ` Steve Grubb
2014-06-03 16:34       ` Tony Jones [this message]
2014-05-29 15:21 ` Tyler Hicks
2014-05-30 19:53 ` Steve Grubb
2014-05-30 20:16   ` Tyler Hicks
2014-05-30 21:00     ` Steve Grubb
2014-05-31  0:01       ` Tony Jones
2014-06-06 18:46       ` Tyler Hicks
2014-06-06 21:10         ` Tyler Hicks
2014-06-24  0:06           ` Tony Jones
2014-06-24 15:34             ` Eric Paris
  -- strict thread matches above, loose matches on Subject: below --
2016-04-29  7:03 Vincas Dargis
2016-04-29 13:39 ` Steve Grubb
2016-04-29 16:07   ` Vincas Dargis
2016-04-29 16:30     ` Steve Grubb
2016-05-02 21:18       ` Paul Moore
2016-04-29 15:41 ` Richard Guy Briggs
2016-04-29 16:58   ` Vincas Dargis

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=538DF911.9010807@suse.de \
    --to=tonyj@suse.de \
    --cc=linux-audit@redhat.com \
    --cc=seth.arnold@canonical.com \
    --cc=sgrubb@redhat.com \
    --cc=wpreston@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.