From: Tony Jones <tonyj@suse.de>
To: Steve Grubb <sgrubb@redhat.com>, Tyler Hicks <tyhicks@canonical.com>
Cc: wpreston@suse.com, linux-audit@redhat.com, seth.arnold@canonical.com
Subject: Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
Date: Fri, 30 May 2014 17:01:39 -0700 [thread overview]
Message-ID: <53891BE3.3060409@suse.de> (raw)
In-Reply-To: <9810096.ghxOlbMYMG@x2>
On 05/30/2014 02:00 PM, Steve Grubb wrote:
> This is a big mistake, IMHO. In theory, this is what should have happened:
> An access decisionl event should have been named in the 1500 block. It would
> then be free to include the field it needs in the order it needs. The ausearch
> would get a function parse_aa_decision. That function would stuff a struct
> specially tuned for AA usage. Aureport would gain a new report.
The very original AA submission logged everything from the kernel using AUDIT_AA which was defined in the submission as:
+#define AUDIT_AA 1500 /* AppArmor audit */
I'm not sure when the change was made to call common_lsm_audit() which logs as AUDIT_AVC. I agree with Steve, doesn't seem a good idea.
tony
next prev parent reply other threads:[~2014-05-31 0:01 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-28 22:33 [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log Tony Jones
2014-05-29 8:31 ` Tyler Hicks
2014-05-29 15:01 ` Steve Grubb
2014-05-29 15:15 ` Tyler Hicks
2014-06-03 1:00 ` Tony Jones
2014-06-03 14:47 ` Steve Grubb
2014-06-03 16:34 ` Tony Jones
2014-05-29 15:21 ` Tyler Hicks
2014-05-30 19:53 ` Steve Grubb
2014-05-30 20:16 ` Tyler Hicks
2014-05-30 21:00 ` Steve Grubb
2014-05-31 0:01 ` Tony Jones [this message]
2014-06-06 18:46 ` Tyler Hicks
2014-06-06 21:10 ` Tyler Hicks
2014-06-24 0:06 ` Tony Jones
2014-06-24 15:34 ` Eric Paris
-- strict thread matches above, loose matches on Subject: below --
2016-04-29 7:03 Vincas Dargis
2016-04-29 13:39 ` Steve Grubb
2016-04-29 16:07 ` Vincas Dargis
2016-04-29 16:30 ` Steve Grubb
2016-05-02 21:18 ` Paul Moore
2016-04-29 15:41 ` Richard Guy Briggs
2016-04-29 16:58 ` Vincas Dargis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53891BE3.3060409@suse.de \
--to=tonyj@suse.de \
--cc=linux-audit@redhat.com \
--cc=seth.arnold@canonical.com \
--cc=sgrubb@redhat.com \
--cc=tyhicks@canonical.com \
--cc=wpreston@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).