From mboxrd@z Thu Jan 1 00:00:00 1970 From: Miroslav Lichvar Subject: Re: [PATCH ghak10 v5 2/2] timekeeping/ntp: Audit clock/NTP params adjustments Date: Mon, 27 Aug 2018 13:45:57 +0200 Message-ID: <20180827114557.GN27091@localhost> References: <20180824120001.20771-1-omosnace@redhat.com> <20180824120001.20771-3-omosnace@redhat.com> <20180824194703.h3mbuhrxzixmna4e@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Ondrej Mosnacek Cc: Richard Guy Briggs , Linux-Audit Mailing List , Linux kernel mailing list , Stephen Boyd , John Stultz , Thomas Gleixner List-Id: linux-audit@redhat.com On Mon, Aug 27, 2018 at 01:35:09PM +0200, Ondrej Mosnacek wrote: > On Fri, Aug 24, 2018 at 9:51 PM Richard Guy Briggs wrote: > > It appears this time_tai use of "constant" is different than > > time_constant, the former not mentioned by Miroslav Lichvar. What is it > > and is it important to log for security? It sounds like it is > > important. > The TAI offset is the offset of the clock from the International > Atomic Time, so basically the time zone offset. I suppose it can't > influence the audit timestamps, but changing timezones can still cause > all sorts of confusion throughout the system, so intuitively I would > say we should log it. It's not related to timezones. ADJ_TAI sets the offset of the system TAI clock (CLOCK_TAI) relative to the standard UTC clock (CLOCK_REALTIME). CLOCK_TAI is rarely used by applications. Setting the TAI offset effectively injects a whole-second offset to the TAI time. -- Miroslav Lichvar