From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [RFC PATCH] New audit message for NetLabel static/fallback labels Date: Wed, 21 Nov 2007 16:37:43 -0500 Message-ID: <200711211637.44057.paul.moore@hp.com> References: <20071121193512.12714.406.stgit@flek.americas.hpqcorp.net> <4744A156.3010308@hp.com> <200711211626.57401.paul.moore@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id lALLcelB017794 for ; Wed, 21 Nov 2007 16:38:40 -0500 Received: from g1t0026.austin.hp.com (g1t0026.austin.hp.com [15.216.28.33]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id lALLc851014540 for ; Wed, 21 Nov 2007 16:38:08 -0500 Received: from g1t0026.austin.hp.com (localhost.localdomain [127.0.0.1]) by receive-from-antispam-filter (Postfix) with SMTP id D78C2C03C for ; Wed, 21 Nov 2007 21:38:02 +0000 (UTC) Received: from smtp1.fc.hp.com (smtp1.fc.hp.com [15.15.136.127]) by g1t0026.austin.hp.com (Postfix) with ESMTP id C16B3C02E for ; Wed, 21 Nov 2007 21:38:02 +0000 (UTC) In-Reply-To: <200711211626.57401.paul.moore@hp.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday 21 November 2007 4:26:57 pm Paul Moore wrote: > On Wednesday 21 November 2007 4:21:26 pm Linda Knippers wrote: > > Paul Moore wrote: > > > For reference, here are four examples of the new message types pulled > > > from a Fedora Rawhide machine running this patch: > > > > > > * adding new fallback label using network interface "lo" and > > > address "127.0.0.0/8" > > > > > > type=UNKNOWN[1416] msg=audit(1195671777.849:32): netlabel: \ > > > auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 \ > > > netif=lo daddr=127.0.0.0 daddr_mask=8 \ > > > sec_obj=system_u:object_r:unlabeled_t:s0 res=1 > > > > At the risk of being nit-picky, it seems like the convention for network > > addresses is either separate address and netmask fields, or the combined > > address/bits-in-netmask notation. For example, ifconfig (on ubuntu, > > anyway) uses the former for IPv4 and the later for IPv6 addresses. > > > > lo Link encap:Local Loopback > > inet addr:127.0.0.1 Mask:255.0.0.0 > > inet6 addr: ::1/128 Scope:Host > > > > These audit records separate the two values but use the bits-in-netmask > > instead of the netmask in dot notation, which seems inconsistent to me. > > Seems like the audit record above should either have an address of > > 127.0.0.0/8 or an address of 127.0.0.0 and a netmask of 255.0.0.0. > > I agree in that I like seeing the netmask attached to the address, but when > I posed the question earlier to the list there was concern that this would > cause breakage in the tools. I just thought of something, would you be > more comfortable if I changed the name from 'daddr_mask' to > 'daddr_prefixlen'? The more I think about this, the more I like the idea of 'daddr_prefixlen', I'm going to go and make that change. Although I'm still unclear of how people would like to see the netmask information - part of the address or separate. For what it is worth I think we are going to need to augment the existing IPsec SPD audit messages to include this information as well (see my other mail). -- paul moore linux security @ hp