From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: [PATCH] Prevent per,success and exit fields from disappearing
	in syscall audit log
Date: Mon, 20 Jan 2014 11:09:45 -0500
Message-ID: <1390234185.21885.2.camel@localhost>
References: <20140120132043.GA3795@pauldc-Inspiron-1470>
	<20140120105152.51e7164f@ivy-bridge>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20140120105152.51e7164f@ivy-bridge>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: rgb@redhat.com, linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Mon, 2014-01-20 at 10:51 -0500, Steve Grubb wrote:
> On Mon, 20 Jan 2014 18:50:43 +0530
> Paul Davies C <pauldaviesc@gmail.com> wrote:
> 
> > This patch prevents the per, success and the exit fields from
> > disappearing from the audit system call log.

Wasn't you who said that fields cannot sometimes exist and sometimes
not?  It seems as though Paul is following your directives and fixing
the present inconsistencies...

> (null) is an unrecognized value for all these fields. It would be
> invalid for all currently written software that processes logs.

> Also, there is a reason why a check for return valid exists. Once upon
> a time about 5-6 years ago, it was found that we can actually get a
> syscall record where the return is not valid. You'd have to search the
> archives to see what caused the patch to be written

I don't understand this comment?  He didn't remove the test...  What are
you trying to convey?

> 
> -Steve
> 
> > Signed-off-by: Paul Davies C <pauldaviesc@gmail.com>
> > ---
> >  kernel/auditsc.c |    4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 9845cb3..3871466 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -1300,10 +1300,14 @@ static void audit_log_exit(struct
> > audit_context *context, struct task_struct *ts context->arch,
> > context->major); if (context->personality != PER_LINUX)
> >  		audit_log_format(ab, " per=%lx",
> > context->personality);
> > +	else
> > +		audit_log_format(ab, " per=(null)");
> >  	if (context->return_valid)
> >  		audit_log_format(ab, " success=%s exit=%ld",
> >  				 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
> >  				 context->return_code);
> > +	else
> > +		audit_log_format(ab, " success=(null) exit=(null)");
> >  
> >  	audit_log_format(ab,
> >  			 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
>