* [PATCH]: revised make xfrm_audit_log more generic patch
@ 2007-07-23 21:46 Joy Latten
2007-07-23 22:27 ` James Morris
2007-07-24 15:04 ` Steve Grubb
0 siblings, 2 replies; 6+ messages in thread
From: Joy Latten @ 2007-07-23 21:46 UTC (permalink / raw)
To: netdev; +Cc: davem, linux-audit, sgrubb
Revised patch that modifies xfrm_audit_log() such that it
can accomodate auditing other ipsec events
besides add/delete of an SA or SPD entry.
This patch differs from original in that it does
not remove existing ipsec audit defines so as
to not break existing audit apps.
This is a small change to accomodate updating
ipsec protocol to RFCs 4301, 4302 and 4303 which
require auditing some ipsec events if auditing
is available. Please let me know if ok.
Regards,
Joy
Signed-off-by: Joy Latten <latten@austin.ibm.com>
diff -urpN linux-2.6.22/include/linux/audit.h linux-2.6.22.patch/include/linux/audit.h
--- linux-2.6.22/include/linux/audit.h 2007-07-23 14:35:28.000000000 -0500
+++ linux-2.6.22.patch/include/linux/audit.h 2007-07-23 14:38:51.000000000 -0500
@@ -112,6 +112,7 @@
#define AUDIT_MAC_IPSEC_DELSA 1412 /* Delete a XFRM state */
#define AUDIT_MAC_IPSEC_ADDSPD 1413 /* Add a XFRM policy */
#define AUDIT_MAC_IPSEC_DELSPD 1414 /* Delete a XFRM policy */
+#define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit IPSec events */
#define AUDIT_FIRST_KERN_ANOM_MSG 1700
#define AUDIT_LAST_KERN_ANOM_MSG 1799
diff -urpN linux-2.6.22/include/net/xfrm.h linux-2.6.22.patch/include/net/xfrm.h
--- linux-2.6.22/include/net/xfrm.h 2007-07-23 14:35:28.000000000 -0500
+++ linux-2.6.22.patch/include/net/xfrm.h 2007-07-23 14:38:51.000000000 -0500
@@ -427,9 +427,11 @@ struct xfrm_audit
#ifdef CONFIG_AUDITSYSCALL
extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
- struct xfrm_policy *xp, struct xfrm_state *x);
+ u16 family, xfrm_address_t saddr,
+ xfrm_address_t daddr, __be32 spi, __be32 flowid,
+ struct xfrm_sec_ctx *sctx, char *buf);
#else
-#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#define xfrm_audit_log(a,i,t,r,f,s,d,p,l,c,b) do { ; } while (0)
#endif /* CONFIG_AUDITSYSCALL */
static inline void xfrm_pol_hold(struct xfrm_policy *policy)
diff -urpN linux-2.6.22/net/key/af_key.c linux-2.6.22.patch/net/key/af_key.c
--- linux-2.6.22/net/key/af_key.c 2007-07-08 18:32:17.000000000 -0500
+++ linux-2.6.22.patch/net/key/af_key.c 2007-07-23 14:38:51.000000000 -0500
@@ -1459,7 +1459,9 @@ static int pfkey_add(struct sock *sk, st
err = xfrm_state_update(x);
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ x->props.family, x->props.saddr, x->id.daddr,
+ x->id.spi, 0, x->security, "SAD add");
if (err < 0) {
x->km.state = XFRM_STATE_DEAD;
@@ -1513,7 +1515,10 @@ static int pfkey_delete(struct sock *sk,
km_state_notify(x, &c);
out:
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, x->props.family,
+ x->props.saddr, x->id.daddr, x->id.spi, 0,
+ x->security, "SAD delete");
+
xfrm_state_put(x);
return err;
@@ -2266,7 +2271,9 @@ static int pfkey_spdadd(struct sock *sk,
hdr->sadb_msg_type != SADB_X_SPDUPDATE);
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ xp->selector.family, xp->selector.saddr,
+ xp->selector.daddr, 0, 0, xp->security, "SPD add");
if (err)
goto out;
@@ -2350,7 +2357,9 @@ static int pfkey_spddelete(struct sock *
return -ENOENT;
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ xp->selector.family, xp->selector.saddr,
+ xp->selector.daddr, 0, 0, xp->security, "SPD delete");
if (err)
goto out;
@@ -2611,7 +2620,10 @@ static int pfkey_spdget(struct sock *sk,
if (delete) {
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ xp->selector.family, xp->selector.saddr,
+ xp->selector.daddr, 0, 0, xp->security,
+ "SPD delete");
if (err)
goto out;
diff -urpN linux-2.6.22/net/xfrm/xfrm_policy.c linux-2.6.22.patch/net/xfrm/xfrm_policy.c
--- linux-2.6.22/net/xfrm/xfrm_policy.c 2007-07-23 14:35:29.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_policy.c 2007-07-23 14:38:51.000000000 -0500
@@ -853,8 +853,11 @@ xfrm_policy_flush_secctx_check(u8 type,
if (err) {
xfrm_audit_log(audit_info->loginuid,
audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 0,
- pol, NULL);
+ AUDIT_MAC_IPSEC_EVENT, 0,
+ pol->selector.family,
+ pol->selector.saddr,
+ pol->selector.daddr, 0, 0,
+ pol->security, "SPD delete");
return err;
}
}
@@ -868,8 +871,12 @@ xfrm_policy_flush_secctx_check(u8 type,
if (err) {
xfrm_audit_log(audit_info->loginuid,
audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD,
- 0, pol, NULL);
+ AUDIT_MAC_IPSEC_EVENT,
+ 0, pol->selector.family,
+ pol->selector.saddr,
+ pol->selector.daddr,
+ 0, 0, pol->security,
+ "SPD delete");
return err;
}
}
@@ -911,7 +918,11 @@ int xfrm_policy_flush(u8 type, struct xf
write_unlock_bh(&xfrm_policy_lock);
xfrm_audit_log(audit_info->loginuid, audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 1, pol, NULL);
+ AUDIT_MAC_IPSEC_EVENT, 1,
+ pol->selector.family,
+ pol->selector.saddr,
+ pol->selector.daddr, 0, 0,
+ pol->security, "SPD delete");
xfrm_policy_kill(pol);
killed++;
@@ -933,8 +944,11 @@ int xfrm_policy_flush(u8 type, struct xf
xfrm_audit_log(audit_info->loginuid,
audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 1,
- pol, NULL);
+ AUDIT_MAC_IPSEC_EVENT, 1,
+ pol->selector.family,
+ pol->selector.saddr,
+ pol->selector.daddr, 0, 0,
+ pol->security, "SPD delete");
xfrm_policy_kill(pol);
killed++;
@@ -2154,44 +2168,23 @@ EXPORT_SYMBOL(xfrm_bundle_ok);
/* Audit addition and deletion of SAs and ipsec policy */
void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
- struct xfrm_policy *xp, struct xfrm_state *x)
+ u16 family, xfrm_address_t saddr, xfrm_address_t daddr,
+ __be32 spi, __be32 flowlabel, struct xfrm_sec_ctx *sctx,
+ char *buf)
{
-
char *secctx;
u32 secctx_len;
- struct xfrm_sec_ctx *sctx = NULL;
struct audit_buffer *audit_buf;
- int family;
extern int audit_enabled;
if (audit_enabled == 0)
return;
- BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
- type == AUDIT_MAC_IPSEC_DELSA) && !x);
- BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
- type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
-
audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
if (audit_buf == NULL)
return;
- switch(type) {
- case AUDIT_MAC_IPSEC_ADDSA:
- audit_log_format(audit_buf, "SAD add: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_DELSA:
- audit_log_format(audit_buf, "SAD delete: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_ADDSPD:
- audit_log_format(audit_buf, "SPD add: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_DELSPD:
- audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
- break;
- default:
- return;
- }
+ audit_log_format(audit_buf, "%s: auid=%u", buf, auid);
if (sid != 0 &&
security_secid_to_secctx(sid, &secctx, &secctx_len) == 0)
@@ -2199,16 +2192,6 @@ void xfrm_audit_log(uid_t auid, u32 sid,
else
audit_log_task_context(audit_buf);
- if (xp) {
- family = xp->selector.family;
- if (xp->security)
- sctx = xp->security;
- } else {
- family = x->props.family;
- if (x->security)
- sctx = x->security;
- }
-
if (sctx)
audit_log_format(audit_buf,
" sec_alg=%u sec_doi=%u sec_obj=%s",
@@ -2216,48 +2199,24 @@ void xfrm_audit_log(uid_t auid, u32 sid,
switch(family) {
case AF_INET:
- {
- struct in_addr saddr, daddr;
- if (xp) {
- saddr.s_addr = xp->selector.saddr.a4;
- daddr.s_addr = xp->selector.daddr.a4;
- } else {
- saddr.s_addr = x->props.saddr.a4;
- daddr.s_addr = x->id.daddr.a4;
- }
- audit_log_format(audit_buf,
- " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
- NIPQUAD(saddr), NIPQUAD(daddr));
- }
- break;
+ audit_log_format(audit_buf,
+ " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
+ NIPQUAD(saddr.a4), NIPQUAD(daddr.a4));
+ break;
case AF_INET6:
- {
- struct in6_addr saddr6, daddr6;
- if (xp) {
- memcpy(&saddr6, xp->selector.saddr.a6,
- sizeof(struct in6_addr));
- memcpy(&daddr6, xp->selector.daddr.a6,
- sizeof(struct in6_addr));
- } else {
- memcpy(&saddr6, x->props.saddr.a6,
- sizeof(struct in6_addr));
- memcpy(&daddr6, x->id.daddr.a6,
- sizeof(struct in6_addr));
- }
- audit_log_format(audit_buf,
- " src=" NIP6_FMT " dst=" NIP6_FMT,
- NIP6(saddr6), NIP6(daddr6));
- }
+ audit_log_format(audit_buf, " src=" NIP6_FMT " dst=" NIP6_FMT,
+ NIP6(*((struct in6_addr *)&saddr.a6)),
+ NIP6(*((struct in6_addr *)&daddr.a6)));
break;
}
- if (x)
- audit_log_format(audit_buf, " spi=%lu(0x%lx) protocol=%s",
- (unsigned long)ntohl(x->id.spi),
- (unsigned long)ntohl(x->id.spi),
- x->id.proto == IPPROTO_AH ? "AH" :
- (x->id.proto == IPPROTO_ESP ?
- "ESP" : "IPCOMP"));
+ if (flowlabel)
+ audit_log_format(audit_buf, " flowlabel=%u", flowlabel);
+
+ if (spi)
+ audit_log_format(audit_buf, " spi=%lu(0x%lx)",
+ (unsigned long)ntohl(spi),
+ (unsigned long)ntohl(spi));
audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf);
diff -urpN linux-2.6.22/net/xfrm/xfrm_state.c linux-2.6.22.patch/net/xfrm/xfrm_state.c
--- linux-2.6.22/net/xfrm/xfrm_state.c 2007-07-23 14:35:29.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_state.c 2007-07-23 14:46:00.000000000 -0500
@@ -303,7 +303,9 @@ expired:
km_state_expired(x, 1, 0);
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ x->props.family, x->props.saddr, x->id.daddr, x->id.spi,
+ 0, x->security, "SAD delete");
out:
spin_unlock(&x->lock);
@@ -406,9 +408,10 @@ xfrm_state_flush_secctx_check(u8 proto,
(err = security_xfrm_state_delete(x)) != 0) {
xfrm_audit_log(audit_info->loginuid,
audit_info->secid,
- AUDIT_MAC_IPSEC_DELSA,
- 0, NULL, x);
-
+ AUDIT_MAC_IPSEC_EVENT, 0,
+ x->props.family, x->props.saddr,
+ x->id.daddr, x->id.spi, 0,
+ x->security, "SAD delete");
return err;
}
}
@@ -446,8 +449,11 @@ restart:
err = xfrm_state_delete(x);
xfrm_audit_log(audit_info->loginuid,
audit_info->secid,
- AUDIT_MAC_IPSEC_DELSA,
- err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT,
+ err ? 0 : 1, x->props.family,
+ x->props.saddr, x->id.daddr,
+ x->id.spi, 0, x->security,
+ "SAD delete");
xfrm_state_put(x);
spin_lock_bh(&xfrm_state_lock);
diff -urpN linux-2.6.22/net/xfrm/xfrm_user.c linux-2.6.22.patch/net/xfrm/xfrm_user.c
--- linux-2.6.22/net/xfrm/xfrm_user.c 2007-07-08 18:32:17.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_user.c 2007-07-23 14:38:51.000000000 -0500
@@ -456,7 +456,9 @@ static int xfrm_add_sa(struct sk_buff *s
err = xfrm_state_update(x);
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ x->props.family, x->props.saddr, x->id.daddr,
+ x->id.spi, 0, x->security, "SAD add");
if (err < 0) {
x->km.state = XFRM_STATE_DEAD;
@@ -539,7 +541,9 @@ static int xfrm_del_sa(struct sk_buff *s
out:
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ x->props.family, x->props.saddr, x->id.daddr,
+ x->id.spi, 0, x->security, "SAD delete");
xfrm_state_put(x);
return err;
}
@@ -1149,7 +1153,9 @@ static int xfrm_add_policy(struct sk_buf
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
err = xfrm_policy_insert(p->dir, xp, excl);
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ xp->selector.family, xp->selector.saddr,
+ xp->selector.daddr, 0, 0, xp->security, "SPD delete");
if (err) {
security_xfrm_policy_free(xp);
@@ -1395,7 +1401,10 @@ static int xfrm_get_policy(struct sk_buf
}
} else {
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+ xp->selector.family, xp->selector.saddr,
+ xp->selector.daddr, 0, 0, xp->security,
+ "SPD delete");
if (err != 0)
goto out;
@@ -1644,8 +1653,9 @@ static int xfrm_add_pol_expire(struct sk
if (up->hard) {
xfrm_policy_delete(xp, p->dir);
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
-
+ AUDIT_MAC_IPSEC_EVENT, 1, xp->selector.family,
+ xp->selector.saddr, xp->selector.daddr, 0, 0,
+ xp->security, "SPD delete");
} else {
// reset the timers here?
printk("Dont know what to do with soft policy expire\n");
@@ -1680,7 +1690,9 @@ static int xfrm_add_sa_expire(struct sk_
if (ue->hard) {
__xfrm_state_delete(x);
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
+ AUDIT_MAC_IPSEC_EVENT, 1, x->props.family,
+ x->props.saddr, x->id.daddr, x->id.spi, 0,
+ x->security, "SAD delete");
}
err = 0;
out:
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH]: revised make xfrm_audit_log more generic patch
2007-07-23 21:46 [PATCH]: revised make xfrm_audit_log more generic patch Joy Latten
@ 2007-07-23 22:27 ` James Morris
2007-07-24 15:04 ` Steve Grubb
1 sibling, 0 replies; 6+ messages in thread
From: James Morris @ 2007-07-23 22:27 UTC (permalink / raw)
To: Joy Latten; +Cc: netdev, davem, linux-audit, sgrubb
On Mon, 23 Jul 2007, Joy Latten wrote:
> Revised patch that modifies xfrm_audit_log() such that it
> can accomodate auditing other ipsec events
> besides add/delete of an SA or SPD entry.
>
> This patch differs from original in that it does
> not remove existing ipsec audit defines so as
> to not break existing audit apps.
>
> This is a small change to accomodate updating
> ipsec protocol to RFCs 4301, 4302 and 4303 which
> require auditing some ipsec events if auditing
> is available. Please let me know if ok.
>
> Regards,
> Joy
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH]: revised make xfrm_audit_log more generic patch
2007-07-23 21:46 [PATCH]: revised make xfrm_audit_log more generic patch Joy Latten
2007-07-23 22:27 ` James Morris
@ 2007-07-24 15:04 ` Steve Grubb
2007-07-24 16:17 ` Joy Latten
2007-07-24 16:33 ` Joy Latten
1 sibling, 2 replies; 6+ messages in thread
From: Steve Grubb @ 2007-07-24 15:04 UTC (permalink / raw)
To: Joy Latten; +Cc: netdev, linux-audit, davem
Hi,
I think we need just one other minor tweak.
On Monday 23 July 2007 17:46:05 Joy Latten wrote:
> @@ -2154,44 +2168,23 @@ EXPORT_SYMBOL(xfrm_bundle_ok);
> /* Audit addition and deletion of SAs and ipsec policy */
>
> void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
> - struct xfrm_policy *xp, struct xfrm_state *x)
> + u16 family, xfrm_address_t saddr, xfrm_address_t
> daddr, + __be32 spi, __be32 flowlabel, struct
> xfrm_sec_ctx *sctx, + char *buf)
> {
> -
> char *secctx;
> u32 secctx_len;
> - struct xfrm_sec_ctx *sctx = NULL;
> struct audit_buffer *audit_buf;
> - int family;
> extern int audit_enabled;
>
> if (audit_enabled == 0)
> return;
>
> - BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
> - type == AUDIT_MAC_IPSEC_DELSA) && !x);
> - BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
> - type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
> -
> audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
> type); if (audit_buf == NULL)
> return;
>
> - switch(type) {
> - case AUDIT_MAC_IPSEC_ADDSA:
> - audit_log_format(audit_buf, "SAD add: auid=%u", auid);
> - break;
> - case AUDIT_MAC_IPSEC_DELSA:
> - audit_log_format(audit_buf, "SAD delete: auid=%u", auid);
> - break;
> - case AUDIT_MAC_IPSEC_ADDSPD:
> - audit_log_format(audit_buf, "SPD add: auid=%u", auid);
> - break;
> - case AUDIT_MAC_IPSEC_DELSPD:
> - audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
> - break;
> - default:
> - return;
> - }
> + audit_log_format(audit_buf, "%s: auid=%u", buf, auid);
>
> if (sid != 0 &&
> security_secid_to_secctx(sid, &secctx, &secctx_len) == 0)
The operation in buf will not be parsed by the user space tools. Let's
use "op=%s " where you have "%s: " above. Audit record fields are name=value
and fields separated by spaces. "op" is what we are using in other places to
mean operation.
I know its a change from the records above, but we previously had some detail
about what operation was being performed by the record type and this did not
matter so much. Now that we only have one event type, the meaning of the
event being recorded needs to be parsable and in a field.
It also wouldn't hurt to change the text being sent to this function to have a
hyphen instead of a space, so "SPD delete" becomes "SPD-delete". This keeps
the parser happy.
This patch otherwise looks good.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH]: revised make xfrm_audit_log more generic patch
2007-07-24 15:04 ` Steve Grubb
@ 2007-07-24 16:17 ` Joy Latten
2007-07-24 16:33 ` Joy Latten
1 sibling, 0 replies; 6+ messages in thread
From: Joy Latten @ 2007-07-24 16:17 UTC (permalink / raw)
To: Steve Grubb; +Cc: netdev, davem, linux-audit
On Tue, 2007-07-24 at 11:04 -0400, Steve Grubb wrote:
> > + audit_log_format(audit_buf, "%s: auid=%u", buf, auid);
> >
> > if (sid != 0 &&
> > security_secid_to_secctx(sid, &secctx, &secctx_len) == 0)
>
> The operation in buf will not be parsed by the user space tools. Let's
> use "op=%s " where you have "%s: " above. Audit record fields are name=value
> and fields separated by spaces. "op" is what we are using in other places to
> mean operation.
>
> I know its a change from the records above, but we previously had some detail
> about what operation was being performed by the record type and this did not
> matter so much. Now that we only have one event type, the meaning of the
> event being recorded needs to be parsable and in a field.
>
> It also wouldn't hurt to change the text being sent to this function to have a
> hyphen instead of a space, so "SPD delete" becomes "SPD-delete". This keeps
> the parser happy.
>
> This patch otherwise looks good.
Sounds good. I will make the changes and resend.
Thanks!!
Joy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH]: revised make xfrm_audit_log more generic patch
2007-07-24 15:04 ` Steve Grubb
2007-07-24 16:17 ` Joy Latten
@ 2007-07-24 16:33 ` Joy Latten
2007-07-24 17:10 ` Steve Grubb
1 sibling, 1 reply; 6+ messages in thread
From: Joy Latten @ 2007-07-24 16:33 UTC (permalink / raw)
To: Steve Grubb; +Cc: netdev, davem, linux-audit
On Tue, 2007-07-24 at 11:04 -0400, Steve Grubb wrote:
> It also wouldn't hurt to change the text being sent to this function to have a
> hyphen instead of a space, so "SPD delete" becomes "SPD-delete". This keeps
> the parser happy.
>
Steve, more for my education, should all entries have this sort of
syntax, that is, a hyphen in it? I imagine some entries might be a
bit more wordy and so I was wondering ahead of time how to do it.
Thanks!!
Joy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH]: revised make xfrm_audit_log more generic patch
2007-07-24 16:33 ` Joy Latten
@ 2007-07-24 17:10 ` Steve Grubb
0 siblings, 0 replies; 6+ messages in thread
From: Steve Grubb @ 2007-07-24 17:10 UTC (permalink / raw)
To: Joy Latten; +Cc: netdev, linux-audit, davem
On Tuesday 24 July 2007 12:33:26 pm Joy Latten wrote:
> > It also wouldn't hurt to change the text being sent to this function to
> > have a hyphen instead of a space, so "SPD delete" becomes "SPD-delete".
> > This keeps the parser happy.
>
> Steve, more for my education, should all entries have this sort of
> syntax, that is, a hyphen in it?
Only if its something that is important to have associated in reports. More
that 1 or 2 hyphens is probably not good.
> I imagine some entries might be a bit more wordy and so I was wondering
> ahead of time how to do it.
The audit logs should be short as possible but contain everything necessary.
You can have language in the record that makes it more understandable for
people reading the raw record, but it won't necessarily be picked up by
report parsers for searching or presentation.
If you want me to help review the choices, let me know offline and we can work
through it.
-Steve
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2007-07-24 17:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-07-23 21:46 [PATCH]: revised make xfrm_audit_log more generic patch Joy Latten
2007-07-23 22:27 ` James Morris
2007-07-24 15:04 ` Steve Grubb
2007-07-24 16:17 ` Joy Latten
2007-07-24 16:33 ` Joy Latten
2007-07-24 17:10 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).