From: Paul Moore <paul@paul-moore.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: Steve Grubb <sgrubb@redhat.com>,
linux-audit@redhat.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH V9 3/3] audit: add audit by children of executable path
Date: Fri, 07 Aug 2015 10:30:02 -0400 [thread overview]
Message-ID: <6430018.ENq3ajkyRS@sifl> (raw)
In-Reply-To: <20150807063715.GB23800@madcap2.tricolour.ca>
On Friday, August 07, 2015 02:37:15 AM Richard Guy Briggs wrote:
> On 15/08/06, Paul Moore wrote:
>
> > I guess what I'm saying is that I'm not currently convinced that
> > there is enough value in this to offset the risk I feel the loop
> > presents. I understand the use cases that you are mentioning, the
> > are the same as the last time we discussed this, but I'm going to
> > need something better than that.
>
> Can you better describe the loop that concerns you? I don't quite see
> it.
It would be the only loop in the patch, look at the for loop in
audit_filter_rules() which iterates up the process' parent chain.
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2015-08-07 14:30 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-05 20:29 [PATCH V9 0/3] audit by executable name Richard Guy Briggs
2015-08-05 20:29 ` Richard Guy Briggs
2015-08-05 20:29 ` [PATCH V9 1/3] audit: clean simple fsnotify implementation Richard Guy Briggs
2015-08-05 20:29 ` Richard Guy Briggs
2015-08-06 20:19 ` Paul Moore
2015-08-06 20:19 ` Paul Moore
2015-08-05 20:29 ` [PATCH V9 2/3] audit: implement audit by executable Richard Guy Briggs
2015-08-05 20:29 ` Richard Guy Briggs
2015-08-06 20:23 ` Paul Moore
2015-08-06 20:23 ` Paul Moore
2015-08-07 6:25 ` Richard Guy Briggs
2015-08-07 6:25 ` Richard Guy Briggs
2015-08-07 14:27 ` Paul Moore
2015-08-05 20:29 ` [PATCH V9 3/3] audit: add audit by children of executable path Richard Guy Briggs
2015-08-06 20:24 ` Paul Moore
2015-08-06 20:24 ` Paul Moore
2015-08-06 21:08 ` Steve Grubb
2015-08-06 21:08 ` Steve Grubb
2015-08-07 0:07 ` Paul Moore
2015-08-07 0:07 ` Paul Moore
2015-08-07 6:37 ` Richard Guy Briggs
2015-08-07 14:30 ` Paul Moore [this message]
2015-08-07 16:03 ` Richard Guy Briggs
2015-08-07 20:47 ` Paul Moore
2015-08-08 5:07 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6430018.ENq3ajkyRS@sifl \
--to=paul@paul-moore.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rgb@redhat.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.