linux-kernel - Re: [PATCH 0/2] security/smack implement logging V2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <49DA32B7.8080004@numericable.fr>
Date:	Mon, 06 Apr 2009 18:49:59 +0200
From:	Etienne Basset <etienne.basset@...ericable.fr>
To:	Eric Paris <eparis@...hat.com>
CC:	LSM <linux-security-module@...r.kernel.org>,
	Casey Schaufler <casey@...aufler-ca.com>,
	linux-audit@...hat.com,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	sgrubb@...hat.com, sds@...ho.nsa.gov
Subject: Re: [PATCH 0/2] security/smack implement logging V2

Eric Paris wrote:
> On Sun, 2009-04-05 at 10:46 +0200, Etienne Basset wrote:
> 
>> the following 2 patches implements auditing of security events for Smack.
>> It tries to implement what Eric Paris suggested, and moves shareable code
>> to include/linux/lsm_audit.h and security/lsm_audit.c.
>> Smack specific logging functions are now defined in smack_access.c
> 
> 
>> type=1400 audit(1238919813.116:21): SMACK[smack_inode_getattr]: action=denied subject="FOO" object="etienne" requested=r pid=6679 comm="bash" path="/home/etienne/Desktop" dev=sda8ino=1237000
> 
> Can we make SMACK[smack_inode_getarr] into key=value pairs too and get
> rid of that extra ':'?  Anyone have naming suggestions?
> 
> lsm=SMACK function=smack_inode_getattr
> 
yes, sure. Maybe just :
lsm=SMACK fn=smack_inode_getattr
I want as much info as possible with as less characters as possible (is this english? :) )

> also: dev=sda8ino=1237000  I'm guessing that was just a typo of you
> putting the example into the e-mail, but you may want to double check.
> 
yeah, bad cut&paste, sorry about that

Etienne

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/