From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH 3rd revision] Add SELinux context support to AUDIT target Date: Thu, 09 Jun 2011 14:56:02 +0200 Message-ID: <4DF0C2E2.5050807@trash.net> References: <4DEDEB99.4070601@netfilter.org> <4DEFC6C9.5030004@googlemail.com> <201106081528.22926.sgrubb@redhat.com> <4DF0BC5F.5040100@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: Steve Grubb , Mr Dash Four , Casey Schaufler , linux-audit@redhat.com, Thomas Graf , netfilter-devel@vger.kernel.org, Al Viro , Pablo Neira Ayuso To: Eric Paris Return-path: Received: from stinky.trash.net ([213.144.137.162]:38557 "EHLO stinky.trash.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756020Ab1FIM4F (ORCPT ); Thu, 9 Jun 2011 08:56:05 -0400 In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: On 09.06.2011 14:52, Eric Paris wrote: > On Thu, Jun 9, 2011 at 8:28 AM, Patrick McHardy wrote: >> Just to make sure, so the conclusion is that the patch is fine as >> it is and anything related to unconvertible secids will be handled >> by SELinux internally? >> > > No. This patch does not get my ACK. Steve is right that silently > dropping information is a big big no no for the audit system and > that's what this patch does. This cannot be wholly handled properly > inside the LSM either. I don't see any patch meeting everyone's > requirements outside of a new one that includes the audit helper I > suggested. OK, I see, thanks.