From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mr Dash Four Subject: Re: [PATCH 2nd revision] Add SELinux context support to AUDIT target Date: Mon, 06 Jun 2011 13:25:56 +0100 Message-ID: <4DECC754.6040003@googlemail.com> References: <4DDE9194.4030303@netfilter.org> <4DDE87F5.9050606@googlemail.com> <4DEA4B44.8050809@googlemail.com> <201106060814.12524.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <201106060814.12524.sgrubb@redhat.com> Sender: netfilter-devel-owner@vger.kernel.org To: Steve Grubb Cc: linux-audit@redhat.com, netfilter-devel@vger.kernel.org, Thomas Graf , Al Viro , Eric Paris , Patrick McHardy , Pablo Neira Ayuso List-Id: linux-audit@redhat.com > Normally there would be an else here to do something like > audit_log_format(ab, " osid=%u", skb->secmark); > so that its recorded numerically if the context could not be looked up. > I disagree! That approach was dropped long ago when the secctx was first introduced to prevent kernel information leaking into userspace (Eric would know more about this as he designed that aspect of it a couple of months ago). So the secctx is either present (and retrievable!) or not present from the (xt_)audit point of view. For more information see net/netfilter/nf_conntrack_standalone.c in the current nf-next tree. In other words, no else is necessary.