From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jiri Olsa <jolsa@redhat.com>
Subject: [RFC] audit support for BPF notification
Date: Fri, 9 Aug 2019 16:18:31 +0200
Message-ID: <20190809141831.GB9377@krava>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
Cc: Stanislav Kozina <skozina@redhat.com>, Yauheni Kaliuta <yauheni.kaliuta@redhat.com>, Toke =?iso-8859-1?Q?H=F8iland-J=F8rgensen?= <toke@redhat.com>, Jiri Benc <jbenc@redhat.com>, Arnaldo Carvalho de Melo <acme@redhat.com>, Jesper Dangaard Brouer <brouer@redhat.com>
List-Id: linux-audit@redhat.com

hi,
I posted initial change that allows auditd to log BPF program
load/unload events, it's in here:
  https://github.com/linux-audit/audit-userspace/pull/104

We tried to push pure AUDIT interface for BPF program notification,
but it was denied, the discussion is in here:
  https://marc.info/?t=153866123200003&r=1&w=2

The outcome of the discussion was to use perf event interface
for BPF notification and use it in some deamon.. audit was our
first choice.

thoughts?

thanks,
jirka