From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Woodhouse Subject: Re: [PATCH] Add audit uid to netlink credentials Date: Wed, 09 Feb 2005 14:17:00 +0000 Message-ID: <1107958621.19262.524.camel@hades.cambridge.redhat.com> References: <20050204165840.GA2320@IBM-BWN8ZTBWA01.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: netdev@oss.sgi.com, davem@davemloft.net, kuznet@ms2.inr.ac.ru To: Linux Audit Discussion In-Reply-To: <20050204165840.GA2320@IBM-BWN8ZTBWA01.austin.ibm.com> Sender: netdev-bounce@oss.sgi.com Errors-to: netdev-bounce@oss.sgi.com List-Id: netdev.vger.kernel.org On Fri, 2005-02-04 at 10:58 -0600, Serge E. Hallyn wrote: > Most audit control messages are sent over netlink. In order to properl= y > log the identity of the sender of audit control messages, we would like > to add the loginuid to the netlink_creds structure, as per the attached > patch. I think it would be better to leave the loginuid in the payload of the audit packets, not put it into generic netlink structures. In the common case where audit messages are being generated by the kernel, the loginuid can be trusted anyway, and doesn't need to be handled by netlink.=20 The only time it's possibly worth verifying it is for the case where userspace is sending AUDIT_USER messages -- for which the process needs CAP_AUDIT_WRITE anyway. And if you're then going to trust the rest of what that process sends, what's wrong with trusting the loginuid which it provides too? Why should it be impossible for a trusted logging d=C3=A6mon to log actio= ns of another process, running with a loginuid other than the loginuid of the d=C3=A6mon? --=20 dwmw2