From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH GHAK16 V5 00/10] capabilities: do not audit log BPRM_FCAPS on set*id Date: Fri, 20 Oct 2017 16:15:00 +1100 (AEDT) Message-ID: References: <20171019130809.2farwdz3uav6vlp3@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Return-path: In-Reply-To: <20171019130809.2farwdz3uav6vlp3@madcap2.tricolour.ca> Sender: owner-linux-security-module@vger.kernel.org To: Richard Guy Briggs Cc: linux-security-module@vger.kernel.org, linux-audit@redhat.com, linux-kernel@vger.kernel.org, Kees Cook , Andy Lutomirski , "Serge E . Hallyn" , Paul Moore , Steve Grubb , Eric Paris List-Id: linux-audit@redhat.com On Thu, 19 Oct 2017, Richard Guy Briggs wrote: > On 2017-10-11 20:57, Richard Guy Briggs wrote: > > The audit subsystem is adding a BPRM_FCAPS record when auditing setuid > > application execution (SYSCALL execve). This is not expected as it was > > supposed to be limited to when the file system actually had capabilities > > in an extended attribute. It lists all capabilities making the event > > really ugly to parse what is happening. The PATH record correctly > > records the setuid bit and owner. Suppress the BPRM_FCAPS record on > > set*id. > > > > Serge? James? Can one of you two take this via your trees since Paul > has backed down citing (reasonably) that it is mostly capabilities > patches rather than audit? Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general -- James Morris