From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH 3rd revision] Add SELinux context support to AUDIT target Date: Thu, 09 Jun 2011 14:56:02 +0200 Message-ID: <4DF0C2E2.5050807@trash.net> References: <4DEDEB99.4070601@netfilter.org> <4DEFC6C9.5030004@googlemail.com> <201106081528.22926.sgrubb@redhat.com> <4DF0BC5F.5040100@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org To: Eric Paris Cc: Steve Grubb , Mr Dash Four , Casey Schaufler , linux-audit@redhat.com, Thomas Graf , netfilter-devel@vger.kernel.org, Al Viro , Pablo Neira Ayuso List-Id: linux-audit@redhat.com On 09.06.2011 14:52, Eric Paris wrote: > On Thu, Jun 9, 2011 at 8:28 AM, Patrick McHardy wrote: >> Just to make sure, so the conclusion is that the patch is fine as >> it is and anything related to unconvertible secids will be handled >> by SELinux internally? >> > > No. This patch does not get my ACK. Steve is right that silently > dropping information is a big big no no for the audit system and > that's what this patch does. This cannot be wholly handled properly > inside the LSM either. I don't see any patch meeting everyone's > requirements outside of a new one that includes the audit helper I > suggested. OK, I see, thanks.