* [PATCH] audit: log the audit_names record type @ 2013-05-08 14:32 Jeff Layton 2013-05-09 13:21 ` Steve Grubb 2013-05-23 14:48 ` [PATCH v2] " Jeff Layton 0 siblings, 2 replies; 4+ messages in thread From: Jeff Layton @ 2013-05-08 14:32 UTC (permalink / raw) To: Eric Paris; +Cc: linux-audit, Al Viro ...to make it clear what the intent behind each record's operation was. In many cases you can infer this, based on the context of the syscall and the result. In other cases it's not so obvious. For instance, in the case where you have a file being renamed over another, you'll have two different records with the same filename but different inode info. By logging this information we can clearly tell which one was created and which was deleted. Signed-off-by: Jeff Layton <jlayton@redhat.com> --- kernel/auditsc.c | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 8d87439..4f90536 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1575,6 +1575,26 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, } } + /* log the audit_names record type */ + audit_log_format(ab, " nametype="); + switch(n->type) { + case AUDIT_TYPE_NORMAL: + audit_log_format(ab, "NORMAL"); + break; + case AUDIT_TYPE_PARENT: + audit_log_format(ab, "PARENT"); + break; + case AUDIT_TYPE_CHILD_DELETE: + audit_log_format(ab, "DELETE"); + break; + case AUDIT_TYPE_CHILD_CREATE: + audit_log_format(ab, "CREATE"); + break; + default: + audit_log_format(ab, "UNKNOWN"); + break; + } + audit_log_fcaps(ab, n); audit_log_end(ab); -- 1.7.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] audit: log the audit_names record type 2013-05-08 14:32 [PATCH] audit: log the audit_names record type Jeff Layton @ 2013-05-09 13:21 ` Steve Grubb 2013-05-09 14:57 ` Jeff Layton 2013-05-23 14:48 ` [PATCH v2] " Jeff Layton 1 sibling, 1 reply; 4+ messages in thread From: Steve Grubb @ 2013-05-09 13:21 UTC (permalink / raw) To: linux-audit; +Cc: Jeff Layton, Al Viro On Wednesday, May 08, 2013 10:32:23 AM Jeff Layton wrote: > ...to make it clear what the intent behind each record's operation was. > > In many cases you can infer this, based on the context of the syscall > and the result. In other cases it's not so obvious. For instance, in > the case where you have a file being renamed over another, you'll have > two different records with the same filename but different inode info. > By logging this information we can clearly tell which one was created > and which was deleted. Space is generally at a premium. Every byte counts. Rather than print strings, which we usually avoid, it might be better to just print the number and let user space convert that to something readable. All of these records are to point out what the object of the syscall is. And my understanding is that these labels are to describe the action or operation being performed. So, maybe naming the field "objact=" or "objop=" would save a couple bytes? -Steve > Signed-off-by: Jeff Layton <jlayton@redhat.com> > --- > kernel/auditsc.c | 20 ++++++++++++++++++++ > 1 files changed, 20 insertions(+), 0 deletions(-) > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 8d87439..4f90536 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1575,6 +1575,26 @@ static void audit_log_name(struct audit_context > *context, struct audit_names *n, } > } > > + /* log the audit_names record type */ > + audit_log_format(ab, " nametype="); > + switch(n->type) { > + case AUDIT_TYPE_NORMAL: > + audit_log_format(ab, "NORMAL"); > + break; > + case AUDIT_TYPE_PARENT: > + audit_log_format(ab, "PARENT"); > + break; > + case AUDIT_TYPE_CHILD_DELETE: > + audit_log_format(ab, "DELETE"); > + break; > + case AUDIT_TYPE_CHILD_CREATE: > + audit_log_format(ab, "CREATE"); > + break; > + default: > + audit_log_format(ab, "UNKNOWN"); > + break; > + } > + > audit_log_fcaps(ab, n); > > audit_log_end(ab); ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] audit: log the audit_names record type 2013-05-09 13:21 ` Steve Grubb @ 2013-05-09 14:57 ` Jeff Layton 0 siblings, 0 replies; 4+ messages in thread From: Jeff Layton @ 2013-05-09 14:57 UTC (permalink / raw) To: Steve Grubb; +Cc: linux-audit, Al Viro On Thu, 09 May 2013 09:21:50 -0400 Steve Grubb <sgrubb@redhat.com> wrote: > On Wednesday, May 08, 2013 10:32:23 AM Jeff Layton wrote: > > ...to make it clear what the intent behind each record's operation was. > > > > In many cases you can infer this, based on the context of the syscall > > and the result. In other cases it's not so obvious. For instance, in > > the case where you have a file being renamed over another, you'll have > > two different records with the same filename but different inode info. > > By logging this information we can clearly tell which one was created > > and which was deleted. > > Space is generally at a premium. Every byte counts. Rather than print strings, > which we usually avoid, it might be better to just print the number and let > user space convert that to something readable. > > All of these records are to point out what the object of the syscall is. And > my understanding is that these labels are to describe the action or operation > being performed. So, maybe naming the field "objact=" or "objop=" would save > a couple bytes? > > -Steve > > > Signed-off-by: Jeff Layton <jlayton@redhat.com> > > --- > > kernel/auditsc.c | 20 ++++++++++++++++++++ > > 1 files changed, 20 insertions(+), 0 deletions(-) > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > index 8d87439..4f90536 100644 > > --- a/kernel/auditsc.c > > +++ b/kernel/auditsc.c > > @@ -1575,6 +1575,26 @@ static void audit_log_name(struct audit_context > > *context, struct audit_names *n, } > > } > > > > + /* log the audit_names record type */ > > + audit_log_format(ab, " nametype="); > > + switch(n->type) { > > + case AUDIT_TYPE_NORMAL: > > + audit_log_format(ab, "NORMAL"); > > + break; > > + case AUDIT_TYPE_PARENT: > > + audit_log_format(ab, "PARENT"); > > + break; > > + case AUDIT_TYPE_CHILD_DELETE: > > + audit_log_format(ab, "DELETE"); > > + break; > > + case AUDIT_TYPE_CHILD_CREATE: > > + audit_log_format(ab, "CREATE"); > > + break; > > + default: > > + audit_log_format(ab, "UNKNOWN"); > > + break; > > + } > > + > > audit_log_fcaps(ab, n); > > > > audit_log_end(ab); The numerical values of these types is an implementation detail in a private kernel header. I don't think we really want to expose those values to userland. How about something like this instead? --------------------[snip]------------------ [PATCH] audit: log the audit_names record type ...to make it clear what the intent behind each record's operation was. In many cases you can infer this, based on the context of the syscall and the result. In other cases it's not so obvious. For instance, in the case where you have a file being renamed over another, you'll have two different records with the same filename but different inode info. By logging this information we can clearly tell which one was created and which was deleted. Signed-off-by: Jeff Layton <jlayton@redhat.com> --- kernel/auditsc.c | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 8d87439..0e44eec 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1575,6 +1575,26 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, } } + /* log the audit_names record type */ + audit_log_format(ab, " objact="); + switch(n->type) { + case AUDIT_TYPE_NORMAL: + audit_log_format(ab, "N"); + break; + case AUDIT_TYPE_PARENT: + audit_log_format(ab, "P"); + break; + case AUDIT_TYPE_CHILD_DELETE: + audit_log_format(ab, "D"); + break; + case AUDIT_TYPE_CHILD_CREATE: + audit_log_format(ab, "C"); + break; + default: + audit_log_format(ab, "U"); + break; + } + audit_log_fcaps(ab, n); audit_log_end(ab); -- 1.7.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2] audit: log the audit_names record type 2013-05-08 14:32 [PATCH] audit: log the audit_names record type Jeff Layton 2013-05-09 13:21 ` Steve Grubb @ 2013-05-23 14:48 ` Jeff Layton 1 sibling, 0 replies; 4+ messages in thread From: Jeff Layton @ 2013-05-23 14:48 UTC (permalink / raw) To: Eric Paris; +Cc: linux-audit, Al Viro ...to make it clear what the intent behind each record's operation was. In many cases you can infer this, based on the context of the syscall and the result. In other cases it's not so obvious. For instance, in the case where you have a file being renamed over another, you'll have two different records with the same filename but different inode info. By logging this information we can clearly tell which one was created and which was deleted. Signed-off-by: Jeff Layton <jlayton@redhat.com> --- kernel/audit.c | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 21c7fa6..d0cd77d 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1535,6 +1535,26 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, } } + /* log the audit_names record type */ + audit_log_format(ab, " objtype="); + switch(n->type) { + case AUDIT_TYPE_NORMAL: + audit_log_format(ab, "NORMAL"); + break; + case AUDIT_TYPE_PARENT: + audit_log_format(ab, "PARENT"); + break; + case AUDIT_TYPE_CHILD_DELETE: + audit_log_format(ab, "DELETE"); + break; + case AUDIT_TYPE_CHILD_CREATE: + audit_log_format(ab, "CREATE"); + break; + default: + audit_log_format(ab, "UNKNOWN"); + break; + } + audit_log_fcaps(ab, n); audit_log_end(ab); } -- 1.7.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-05-23 14:48 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-05-08 14:32 [PATCH] audit: log the audit_names record type Jeff Layton 2013-05-09 13:21 ` Steve Grubb 2013-05-09 14:57 ` Jeff Layton 2013-05-23 14:48 ` [PATCH v2] " Jeff Layton
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox