From: Richard Guy Briggs <rgb@redhat.com>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: "linux-audit@redhat.com" <linux-audit@redhat.com>
Subject: Re: [RFC PATCH] audit-testsuite: tests for subject and object correctness
Date: Mon, 2 Nov 2020 20:19:25 -0500 [thread overview]
Message-ID: <20201103011925.GF55072@madcap2.tricolour.ca> (raw)
In-Reply-To: <6c950188-a516-e9ed-caa5-42de40861596@schaufler-ca.com>
On 2020-11-02 14:51, Casey Schaufler wrote:
> On 11/2/2020 2:08 PM, Richard Guy Briggs wrote:
> > On 2020-11-02 13:54, Casey Schaufler wrote:
> >> Verify that there are subj= and obj= fields in a record
> >> if and only if they are expected. A system without a security
> >> module that provides these fields should not include them.
> >> A system with multiple security modules providing these fields
> >> (e.g. SELinux and AppArmor) should always provide "?" for the
> >> data and also include a AUDIT_MAC_TASK_CONTEXTS or
> >> AUDIT_MAC_OBJ_CONTEXTS record. The test uses the LSM list from
> >> /sys/kernel/security/lsm to determine which format is expected.
> >>
> >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> >> ---
> >> tests/Makefile | 1 +
> >> tests/multiple_contexts/Makefile | 12 +++
> >> tests/multiple_contexts/test | 166 +++++++++++++++++++++++++++++++
> >> 3 files changed, 179 insertions(+)
> >> create mode 100644 tests/multiple_contexts/Makefile
> >> create mode 100755 tests/multiple_contexts/test
> >>
> >> diff --git a/tests/Makefile b/tests/Makefile
> >> index a7f242a..f20f6b1 100644
> >> --- a/tests/Makefile
> >> +++ b/tests/Makefile
> >> @@ -18,6 +18,7 @@ TESTS := \
> >> file_create \
> >> file_delete \
> >> file_rename \
> >> + multiple_contexts \
> > "context" is a bit ambiguous. Could this be named something to indicate
> > a security context rather than any other sort, such as audit or user
> > context?
>
> Would "subj_obj_fields" be better?
That is much more obvious to me. Maybe even sec_context_multi, but I
like your suggestion better?
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-11-03 1:19 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <e4bf30e2-a92f-99b7-30d0-3e3473e30399.ref@schaufler-ca.com>
2020-11-02 21:54 ` [RFC PATCH] audit-testsuite: tests for subject and object correctness Casey Schaufler
2020-11-02 22:08 ` Richard Guy Briggs
2020-11-02 22:51 ` Casey Schaufler
2020-11-03 1:19 ` Richard Guy Briggs [this message]
2020-11-03 3:31 ` Paul Moore
2020-11-03 12:00 ` Richard Guy Briggs
2020-11-07 0:51 ` Casey Schaufler
2020-11-08 13:38 ` Paul Moore
2020-11-09 13:07 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201103011925.GF55072@madcap2.tricolour.ca \
--to=rgb@redhat.com \
--cc=casey@schaufler-ca.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox