From: Lenny Bruzenak <lenny@magitekltd.com>
To: selinux@tycho.nsa.gov, linux-audit@redhat.com
Subject: Re: [PATCH] Fix AUDIT_MAC_POLICY_LOAD event formatting
Date: Tue, 22 Nov 2016 12:53:05 -0600 [thread overview]
Message-ID: <d9a25cdc-0c3c-755a-d82d-4af2b866b65e@magitekltd.com> (raw)
In-Reply-To: <1be21bc4-e70f-092f-13cb-458cc0beefad@tycho.nsa.gov>
[-- Attachment #1.1: Type: text/plain, Size: 710 bytes --]
On 11/22/2016 08:55 AM, Stephen Smalley wrote:
>> >OK. We can move the point where res=1 is set. But I would think that its a
>> >requirement to have an audit record that states that policy failed to load.
>> >FMT_MSA.3 Static Attribute Initialization. Auditable events: All modifications
>> >of the initial value of security attributes. I would think this means changes
>> >such as booleans, modifying labels, loading a new policy, or failure to load a
>> >policy.
> Failure to load a policy is not a modification to the initial value of
> the security attribute, is it?
>
It is definitely relevant, if it falls under another category.
Either a failed malicious intent or a failed supervisory function.
LCB
[-- Attachment #1.2: Type: text/html, Size: 1416 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
next prev parent reply other threads:[~2016-11-22 18:53 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-21 17:30 [PATCH] Fix AUDIT_MAC_POLICY_LOAD event formatting Steve Grubb
2016-11-21 21:50 ` Paul Moore
2016-11-21 22:51 ` Steve Grubb
[not found] ` <CAHC9VhSYkymKzvbOW1vkZ_Ae=VGZc8TcMKimyXO0iO7e6M8GzQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-22 13:56 ` Stephen Smalley
2016-11-22 14:28 ` Steve Grubb
2016-11-22 14:55 ` Stephen Smalley
2016-11-22 18:53 ` Lenny Bruzenak [this message]
2016-11-22 19:39 ` Steve Grubb
2016-11-22 19:47 ` Stephen Smalley
2016-11-22 20:13 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d9a25cdc-0c3c-755a-d82d-4af2b866b65e@magitekltd.com \
--to=lenny@magitekltd.com \
--cc=linux-audit@redhat.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox