From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030999AbcGKRKM (ORCPT ); Mon, 11 Jul 2016 13:10:12 -0400 Received: from mail-it0-f68.google.com ([209.85.214.68]:34028 "EHLO mail-it0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932315AbcGKRKJ (ORCPT ); Mon, 11 Jul 2016 13:10:09 -0400 Date: Mon, 11 Jul 2016 13:09:37 -0400 From: Tejun Heo To: Topi Miettinen Cc: linux-kernel@vger.kernel.org, ebiederm@xmission.com, mladek@suse.com, luto@kernel.org, serge@hallyn.com, keescook@chromium.org, Paul Moore , Eric Paris , Li Zefan , Johannes Weiner , Serge Hallyn , "moderated list:AUDIT SUBSYSTEM" , "open list:CONTROL GROUP (CGROUP)" , "open list:CAPABILITIES" Subject: Re: [PATCH] capabilities: audit capability use Message-ID: <20160711170711.GB3337@htj.duckdns.org> References: <1468235672-3745-1-git-send-email-toiwoton@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1468235672-3745-1-git-send-email-toiwoton@gmail.com> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Mon, Jul 11, 2016 at 02:14:31PM +0300, Topi Miettinen wrote: > [ 28.443674] audit: type=1327 audit(1468234333.144:520): proctitle=6D6B6E6F64002F6465762F7A5F343639006300310032 > [ 28.465888] audit: type=1330 audit(1468234333.144:520): cap_used=0000000008000000 > [ 28.482080] audit: type=1331 audit(1468234333.144:520): cgroups=:/test; Please don't put additions of the two different audit types into one patch and I don't think the cgroup audit logging makes much sense. Without logging all migrations, it doesn't help auditing all that much. Also, printing all cgroup membership like that can be problematic for audit it can be arbitrarily long. Thanks. -- tejun