Re: [PATCH -v3] SELinux: Convert avc_audit to use lsm_audit.h

[Steve Grubb <sgrubb@redhat.com>]

On Friday 14 August 2009 10:51:41 am Stephen Smalley wrote:
> BTW, it looks to my untrained eye as if dump_common_audit_data() allows
> one to pass a separate target task in the union, in which case we'll get
> two sets of pid= and comm=  data in the same record, one for the subject
> and one for the target/object.  It appears that Smack is already using
> that facility for things like ptrace, kill, etc, whereas SELinux is not.

They should not be doing that. When another process is the object, we have 
specific auxiliary audit records to record this. We have to do this for CAPP so 
MAC systems should not have to do this. See AUDIT_OBJ_PID.

> Two questions:
> 1) Will the multiple pid= comm= entries get handled correctly by auditd
> and the audit tools? Do we need separate names for the target vs source
> pid/comm values?

Yes, we need to record the object information. But we have a record type for 
that already AUDIT_OBJ_PID.

> 2) Should we start using ad.u.tsk in SELinux as well to capture the
> target of a ptrace, kill, wait, ... in the avc audit record?

It should be captured. I thought it was for the LSPP work we did. If for some 
reason its not recorded, then audit_log_pid_context() should be called.

-Steve