From: Laurent Bigonville <bigon@debian.org>
To: linux-audit@redhat.com
Subject: Re: Unique audit record type ranges for individual LSMs
Date: Mon, 18 Dec 2017 11:28:17 +0100 [thread overview]
Message-ID: <8f9fb732-9afd-04fb-ff30-84484374afcd@debian.org> (raw)
In-Reply-To: <4491cccc-9219-f653-0c1d-f8dd6612f0f1@canonical.com>
Le 06/12/17 à 18:51, Tyler Hicks a écrit :
> If so, does everyone agree that 1500-1599 would be acceptable for
> AppArmor to use?
FTR, the apparmor usespace library seems to support the 15xx range for
quite sometimes already, I see the following commit in the git repository:
commit a6a88a4dd7ec9fd59b01c27f8cd40f653386107b
Author: Steve Beattie <steve@nxnw.org>
Date: Fri Sep 14 14:00:48 2007 +0000
This patch adds support to the logparsing library for the type=15xx
flags when events come through the audit subsystem. It also fixes the
case where the audit daemon has not been configured with apparmor
support and the events are reported as type=UNKNOWN[15xx].
It also fixes the testsuite dependencies so that they will get relinked
when the library changes.
This commits contains the following used id's:
+/* FIXME: this ought to be pulled from <linux/audit.h> but there's no
+ * guarantee these will exist there. */
+#define AUDIT_APPARMOR_AUDIT 1501 /* AppArmor audited grants */
+#define AUDIT_APPARMOR_ALLOWED 1502 /* Allowed Access for learning */
+#define AUDIT_APPARMOR_DENIED 1503
+#define AUDIT_APPARMOR_HINT 1504 /* Process Tracking information */
+#define AUDIT_APPARMOR_STATUS 1505 /* Changes in config */
+#define AUDIT_APPARMOR_ERROR 1506 /* Internal AppArmor Errors */
+
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2017-12-18 10:38 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-06 17:51 Unique audit record type ranges for individual LSMs Tyler Hicks
2017-12-06 18:47 ` Casey Schaufler
2017-12-06 19:12 ` Tyler Hicks
2017-12-11 15:44 ` Steve Grubb
2017-12-11 20:56 ` Casey Schaufler
2017-12-12 3:42 ` Steve Grubb
2017-12-11 15:35 ` Steve Grubb
2017-12-18 10:28 ` Laurent Bigonville [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8f9fb732-9afd-04fb-ff30-84484374afcd@debian.org \
--to=bigon@debian.org \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox